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foreword 


This new quarterly in the U. S. Atomic Energy Commission’s Technical Prog- 
ress Review Series has been prepared by the Oak Ridge National Laboratory at 
the request of the Commission’s Division of Information Services. It is intended 
to assist those interested in keeping abreast of significant developments in the 
field of nuclear safety. Nuclear Safety is not intended to be a comprehensive 
abstract of ail literature published in this field during a given quarter; rather it 
is a mechanism for presenting concise reviews of selected subjects from time 
to time as prevailing interest and available information warrant. 

Coverage of the Review is limited to topics relevant to the analysis and con- 
trol of hazards associated with nuclear reactors; operations involving fission- 
able materials; and the products of nuclear fission. Primary emphasis is on 
safety in reactor design, construction, and operation; however, safety consider- 
ations in reactor fuel fabrication, spent fuel processing, nuclear waste disposal, 
and related operations are also treated. Safety in the use of radioisotopes in 
industry, medicine, and research is excluded as are most topics considered the 
province of health physics. Even with these exclusions, nuclear safety cuts 
across such diverse fields as nuclear physics, solid state physics, mechanics, 
chemistry, meteorology, geology, seismology, metallurgy, law, and nearly all 
branches of engineering. The authors will therefore review material from these 
fields which, in their opinion, has a direct bearing on nuclear safety. 

In planning this first issue the editors made two arbitrary decisions. The 
first of these was that no attempt would be made to bring the reader up to date 
regarding developments of the past five or ten years. The second, and this was 
largely a matter of administrative convenience, was that the Review would be 
nominally limited to literature received by the Oak Ridge National Laboratory 
during the first five months of 1959. Some references to earlier literature are 
cited, however, and the reader is also referred to the wealth of nuclear safety 
information presented at the 1958 Geneva Conference. Subsequent issues of 
Nuclear Safety will review material issued during the quarter preceding manu- 
script preparation. 

Interpretations, where given, represent the opinions of the editors who are 
employed by the Oak Ridge National Laboratory. Readers are urged to consult 
the references to original work for more complete information. Many members 
of the ORNL staff wrote review material, reviewed manuscript, or otherwise 
contributed to this publication. Their contributions are gratefully acknowledged. 


W. B. COTTRELL, Editor 

R. A. CHARPIE, Advisory Editor 

C. G. BELL, H. N. CULVER,* L. C. EMERSON, 

L. A. MANN, C. S. WALKER, Assistant Editors 
Oak Ridge National Laboratory 


*On loan from the Tennessee Valley Authority. 
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NUCLEAR SAFETY CRITERIA 





Biological and Economic 
Considerations 


There is a broad spectrum of opinion as to the 
proper degree of emphasis on different criteria 
for evaluating the hazards involved in utilizing 
nuclear energy. The individual approaches ex- 
press individual judgments as to the “most 
proper,’’ “most desirable,’’ or “most practi- 
cal’? combinations of economic, biological, and 
philosophical considerations. 

One approach is exemplified in a recent 
analysis by Siddall.' He suggests that, as a 
solution to the economic problem of the cost of 
protection, a quantitative balance be established 
between the probable consequences of accidents 
and the cost of safety measures. The balance 
would include both humanitarian aspects and 
purely economic factors. He outlines the pres- 
ent acceptance of hazards, accidents, anddeaths 
in“conventional’’ industries and in other ac- 
tivities and analyzes the acceptance quantita- 
tively on an economic basis. For example,’ 
the general public in the United States has been 
accepting an accident death rate in private 
motoring of about one death per 30 million 
passenger miles (or one death per $930,000, 
at 3.5 cents per passenger-mile). Statistics are 
introduced to show that the “safety index’’ of 
all industries combined is about $50 million 
per accidental death, with individual cases 
ranging from $5.2 million for coal mining to 
$200 million for automobile manufacturing. 
The electrical industry, including the mining 
and transportation of coal, is pointed out asa 
particularly pertinent case, with an index of 
about $10 million per accidental death. 

A target index of $50 million per death is 
proposed for the nuclear energy industry. A 
particular example would be a 200 Mw/(e) nu- 
Clear electric power station operating at a 0.8 


load factor and selling power at 6 mills/kw-hr. 
An average of 0.17 deaths per year would be 
accepted on the proposed basis ($8.4 million/ 
$50 million = 0.17). 

On a purely economic basis, it is submitted 
that the minimum sum of the cost of accidents 
plus the cost of accident prevention is a logical 
criterion. The total cost of accidents includes 
loss of revenue during down-time of the dis- 
abled plant, costs of repairs and lost equip- 
ment, and costs of compensation for personal 
and property damage. Costs of accident pre- 
vention include money spent on research and 
development in accident prevention fields, on 
more expensive materials, larger safety fac- 
tors, multiplication and diversification of safety- 
sensitive components, and on enclosing shells 
and exclusion areas. 


Accident costs and the costs of accident pre- 
vention can be reduced to a common basis, such 
as equivalent annual charges by application of 
the correct interest and repayment rates. In 
aiming for the lowest total cost, it is submitted 
that money spent on reducing accidents is more 
useful than that spent on containing accidents, 
particularly if the container makes rescue and 
repair work more difficult, as may be the case. 


The analysis proposes that 2 per cent of the 
gross revenue is a reasonable target cost of 
accidents, corresponding to an insurance pre- 
mium. It is proposed that further safety meas- 
ures are probably not justified once the ac- 
cident cost is reduced to this level. On this 
basis, the target accident cost for a 200 Mw(e) 
nuclear plant would be $168,000 per year. 

Referring to AEC report WASH-740 for data 
on consequences of major accidents, Siddall’s 
analysis derives simultaneous economic and 
humanitarian (deaths per year) equations in 
terms of the preceding parameters to calculate 


1 











2 NUCLEAR SAFETY 


the particular case of the 200 Mw(e) plant cited 
above. The following criteria result. 

1. The primary coolant system must be de- 
signed so that it will not burst more often than 
an average of once in 50 years. 

2. The protective system must not completely 
fail more often than on one occasion in 500, 
despite failures of the operational controls and 
bursting of the primary coolant container; par- 
tial failures must not be experienced on more 
than one occasion in 50. 

3. The operational control system must not 
fail at full speed in the direction of increased 
reactivity more often than once in 160 years. 
Partial failures of this type can be tolerated 
once in 16 years. 


It is submitted that, in the light of present 
knowledge and techniques, these targets seem 
to be reasonably attainable. 

The author notes that the probable errors in 
employing this process are large. He believes, 
however, that this defect would be offset by the 
warnings provided by minor incidents (a con- 
clusion not fully shared by some, as indicated 
in Beck’s comments). He proposes that in 
control systems, for example, statistical ex- 
perience can be built up on minor mishaps that 
cause no Significant damage. 

The conclusion of the analysisisthat: “Meet- 
ing of performance targets can be checked 
from experience in time to avoid major acci- 
dents. If targets are met, money spent on a 
containing shell and consequent additions would 
be wasted. Economically, the reduction in cost 
of accidents would be less than the annual 
charges on the shell. From the humanitarian 
viewpoint, the money would have been better 
spent on safety measures in a dangerous in- 
dustry, or better still, on medical research.’ 

Comments on Siddall’s approach were made‘ 
by each of four men of international stature in 
the field of nuclear energy.* Each complimented 





*C. K. Beck, Chief, Hazards Evaluation Branch, 
U.S. Atomic Energy Commission; W. B. Lewis, 
Atomic Energy of Canada, Limited; Manson Benedict, 
Department of Nuclear Engineering, Massachusetts 
Institute of Technology, and member of the AEC Ad- 
visory Committee on Reactor Safeguards; and Gunnar 
Randers, Director, Joint Establishment for Nuclear 
Energy Research, Lillestrom, Norway. 


Siddall’s report! as a Significant contribution 
to the philosophy of approach in this difficult 
subject of placing reasonable limitations on the 
costs of nuclear safety. Beck, while commend- 
ing the bold approach, warned of some practi- 
cal difficulties of attempting to use the proposals 
submitted. ; 

1. Since the parameters cover such a wide 
range of values and the values are souncertain, 
confidence in the calculated results would be 
low. 

2. Some of the calculational manipulations 
and procedures are “dubious.’’ 

3. There is some question that one could 
safely depend on the occurrence of small and 
intermediate accidents to warn of impending 
major accidents. 

4. Many of the people who would be affected 
by nuclear accidents would not have accepted 
the risks voluntarily, as does a coal miner or 
factory worker, for example. 

5. The extent of genetic damage to significant 
portions of future generations has not been 
determined. 


The importance of learning to live with the 
potentially hazardous technology of nuclear 
energy in order to enjoy its benefits has been 
discussed from the standpoint of the biologist 
by Bruner.’ As he points out, the excellent 
safety record of the nuclear industry demon- 
strates that it is possible to develop and put 
into practice a complete health-protection pro- 
gram which does not impede operations but 
which could result in award-winning safety 
records anywhere in the world. The solution 
to the problem lies in the application and ex- 
pansion of approaches and attitudes toward 
health protection developed in the early days 
of the Manhattan Project. These included: 

1. A broadly conceived research program to 
obtain more information on the biological éf- 
fects of ionizing radiation. 

2. Active participation of medical, safety, 
and health-protection staffs in the planning and 
designing of processes and equipment. 

3. Incorporation of recommended safety fac- 
tors regardless of cost. 

4. Continued detailed medical supervision of 
operations and personnel. 


Although experience indicates that “radiation 
problems,” if met intelligently and vigilantly, 
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need not stand in the way of the large-scale 
development of atomic energy, the records also 
indicate that foolish and unpredictable chance 
exposures probably never will be completely 
eliminated. Thus the expansion of the nuclear 
industry and the accompanying scatter of ac- 
cidents will undoubtedly lead to an increase in 
human cost. The continuation of effective de- 
velopmental and basic research at a rate pro- 
portional to the number of reactors andamounts 
of byproducts may well decrease the percentage 
incidence so as to hold the absolute number of 
accidents to a negligible level. As long as an 
approach is followed which places biological 
acceptability ahead of monetary and engineer- 
ing considerations it will be possible to achieve 
and maintain control of radiation and radio- 
activity such that the ecological systems of the 
surfaces of the earth can remain undamaged. 

It is seen from the foregoing that the ap- 
proach to nuclear-safety planning recommended 
by a biologist places biological considerations 
above those of econorhics and engineering, which 
is in sharp contrast to the approach suggested 
by Siddall! of striking a quantitative balance be- 
tween the cost of safety measures and the con- 
sequences of a nuclear accident. A third ap- 
proach, differing from both of these, is suggested 
by Stubbart,° an engineer with Gibbs and Hill, 
Inc., who argues that one should include only 
those safety measures that the customers de- 
mand, or, in other words, “meet the competi- 
tion.”” He uses as his argument the fact that 
European engineers and managers of European 
utilities have satisfied themselves that the gas- 
cooled reactor plant without a container type of 
building meets their safety requirements, and 
yet Americans are insisting that they accept 
more stringent measures. He concludes that 
we should give the Europeans what they want 
and adjust our designs to satisfy their require- 
ments. If an enclosure is not required by the 
Specifications, it should not be included in the 
vendor’s bid. Conversely, if the site requires 
an enclosure it should be designed by the 
Client’s consulting engineer and priced with the 
structure and not with the reactor plant. 

Such an approach tends to overlook the fact 
that different types of reactors may require 
different degrees of containment and that the 
Safety standards set by European customers 
May not be applicable to American-built reac- 


tors. The problem of radiation protection tran- 
scends national boundaries since a major re- 
lease of radioactivity from an American-built 
plant would be a serious setback to the United 
States nuclear industry whether the plant were 
built in Europe or the United States. Nuclear 
plants constructed in. foreign countries, there- 
fore, should be built to meet the same safety 
criteria as those established for domestic 
plants. It remains only to establish what these 
criteria should be. 


Stubbart presents the following points to show 
that a pressurized-water reactor is inherently 
safer than a gas-cooled graphite reactor of the 
Calder Hall type. 2 

1. For meltdown of fuel elements to occur in 
a pressurized-water reactor, the surface tem- 
perature of the stainless-steel or zirconium 
cladding must reach 2700 to 3300° F compared 
with about 1200°F for the magnesium-alloy- 
clad fuel of the type used in present gas-cooled 
reactors. 

2. More attention to detail is usually given 
in the design of a high-pressure system than a 
low-pressure system in recognition of a haz- 
ardous situation. In any event, piping systems 
for both high and low pressures are designed 
with the same safety factors. 

3. A gas-cooled reactor contains no liquid 
to absorb heat through evaporation, whereas 
water left in the reactor vessel after a rupture 
has heat-removal capability through evapora- 
tion. 

4. A quick-acting chemical fluid neutron poi- 
son can be used in a pressurized-water reactor 
to provide an additional increment of safety. 
There are no practical poisoning systems for 
gas-cooled reactors. 


These arguments in favor of a pressurized- 
water reactor are open to question. For ex- 
ample, first, point 1 depends on the choice of 
cladding rather than the type of reactor. Stain- 
less-steel-clad fuel elements can be used in 
gas-cooled reactors to eliminate the difficulty 
introduced through the use of a low-melting 
cladding material. Second, the primary con- 
sideration in comparing high- andlow-pressure 
systems is not the relative integrity of the two 
piping systems, but the fact that if a rupture 
did occur, vaporization of the high-pressure 
coolant would result in greater dispersion of 








radioactive material. This would be especially 
true if the reactor were not completely con- 
tained. 


Designers of gas-cooled reactors refute points 
3 and 4 by pointing out that the low power den- 
sity of gas-cooled reactors, though objection- 
able from an economic standpoint, results in 
greater safety since natural circulation of the 
gas is adequate to remove the heat generated 
after shutdown. For this reason, an emergency 
shutdown system employing a fluid poison, such 
as proposed for the pressurized-water system, 
.is believed not to be necessary. (J. A. Lane) 


Site-selection Criteria 


Criteria for selecting a reactor site have 
never been specifically defined. In practice, 
site approval is in the hands of the AEC safe- 
guard groups (see page 40) which judge each 
case on its own merits. Senator Clinton P. 
Anderson,’ Chairman, Joint Committee on 
Atomic Energy, stated in March, “I believe we 
are about at the stage where the Congress 
should consider whether to require the AEC to 
establish (by means of a regulation) criteria 
for the selection of sites for atomic power 
plants. Along with the criteria might be a re- 
quirement that applicants for a construction 
permit must submit alternative site proposals, 
with a further proviso that no permit should 
initially be issued for a site tentatively disap- 
proved by the Advisory Committee on Reactor 
Safeguards.”’ 

In May 1959, the AEC published, in the 
Federal Register,’ a notice concerning reactor- 
site criteria. Factors considered in site evalua- 
tion for power and test reactors are the follow- 
ing: exclusion distance around power and test 
reactors, population density in surrounding 
areas, meteorology, seismology, hydrology and 
geology, and the interrelation of these factors. 
The entire notice is reprinted as an appendix 
at the end of this section. 


This notice, however, contains only a general 
reference to the influence of the reactor design 
on the choice of a suitable site. This aspect of 
site selection has been treated in more detail 
by Beck.® 

“Basically, the biggest variable in the choice 
of sites for reactors is the reactor itself. ... 
The four major features of the reactor and its 
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associated equipment which must be known for 
a given site to be evaluated are as follows: 

1. The quantity, identity, and physical nature 
of the fission-product inventory. 

2. The quantity and identity of the radio- 
activity releases which may result from routine 
operations. 

3. The likelihood of accidental releases, the 
nature of the possible accidents, and the portion 
of the fission-product inventory that might be 
released. 

4. The special containment, shielding, mis- 
sile, and other protection features afforded by 
the facility. ... 


“The quantity of fission products contained in 
a reactor is directly related to the power level 
at which the reactor is operated. After short 
periods of operation, about 10 curies per ther- 
mal watt of power level is in the reactor at 
shutdown, but this builds up to only five or six 
times as much after extended operation at the 
same power level. On the other hand, the na- 
ture of the radioactivity inventory at a given 
power level is directly dependent on the ir- 
radiation time or on the length of the fuel cycle. 
After 1 hr of operation the radioactivity of the 
fission products is mostly short-lived; in one 
year it would decay by a factor of about one 
million. After one year of operation, the pro- 
portionate amount of long-lived fission products 
is much higher; decay for a year after such 
operation reduces the level by a factor of less 
than 100.” (J. A. Lane) 


The notice in the Federal Register prompted 
more than 20 replies, principally from persons 
in the American nuclear industry and state or 
city health departments. These letters are 
filed at the AEC Public Document Room, Wash- 
ington, D. C., and are summarized in the June 
15 and 22 issues of the Afomic Energy Clearing 
House."® With few exceptions the letters agreed 
to the need for site criteria, but varied con- 
siderably regarding the adequacy of the pro- 
posed criteria. The proposed criteria were 
criticized generally for being too vague. The 
most objection was directed toward establishing 
an exclusion radius and locating “large’’ reac- 
tors 10 to 20 miles from “large’’ cities. The 
proposed criteria of remoteness from populated 
centers cannot anticipate future population 
shifts, nor would they appear realistic in so far 
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as mobile reactors are concerned. Several 
letters noted that the real objective of these 
proposed criteria is to limit the off-site ex- 
posure; thus, if the exposure criteria were set, 
the reactor designer would be able to design 
for the optimum combination of exclusion radius 
and containment leakage for his particular 
reactor. 


The letters from state health authorities 
frequently commented on the apparent omission 
of criteria for agricultural land, crops, and 
livestock, and also expressed interest in par- 
ticipating in site approval decisions. 


It was stated in one of the letters that the 
chief purpose of the regulation was to establish 
the formula for financial protection. Whether 
or not this is true, it is apparent that the 
criteria for site selection and financial liability 
are closely related. The establishment of an 
exposure standard which the reactor plant must 
meet might then permit the assessment of 
financial liability on the basis of the surround- 
ing population density and land value. 

(W. B. Cottrell) 


Safety in Experimental Systems 


In the design and operation of reactors for 
testing materials and experimental systems, it 
is necessary to consider the effects of the ex- 
perimental system on the reactor, as well as 
the hazards of the test reactor and the experi- 
mental system individually. A guide''to assist 
experiment sponsors in making hazards analy- 
ses of experimental systems for operation at 
the Materials Testing Reactor (MTR) and Engi- 
neering Test Reactor (ETR) has been prepared 
by the Phillips Petroleum Co. In this guide is 
given a brief comparison of the hazards perti- 
nent to both reactor design and experiment 
design. Methods of calculation and means of 
obtaining design approval are not included; 
rather, the report serves to highlight the fac- 
tors which must be considered in the design to 
obtain approval of experiment safety, including 
heat transfer, chemical reactions, and reac- 
tivity. Specific accidents are postulated and 
general protective design features, such as 
sample containment, are discussed. The report 
is brief and serves only as an introduction, 
with emphasis on safety, to the series of re- 


| ports covering specific features of reactor 


experiment design of which it is a part. Other 
reports in the series are referenced. 


An example of a hazards analysis of an in- 
pile experiment is the analysis of the KAPL- 
F-10 experiment” in the ETR. Analyses are 
made of the credible accidents, including the 
maximum credible. accident (mca). The test 
system described (Report KAPL-35) is a pres- 
surized-water loop. Its essential feature is a 
specially designed tube to fit into the F-10 
facilitv of the ETR in which specimens of ma- 
terial ,oison, or fuel may be tested at high 
neutron fluxes. The systems are designed as 
follows: a primary circulating system with a 
pressurizer; two auxiliary cooling systems 
(one forced flow and one convection flow) for 
cooling the in-pile tube; a water purification 
and sampling system; a primary water make-up 
system; a demineralized water system for re- 
moving heat from the primary system and for 
other cooling for which pure water is required; 
a utility cooling water system connected to the 
reactor secondary cooling water stream; a 
tube annulus system for maintaining dry air in 
the in-pile tube annulus which thermally insu- 
lates the inner tube from the ETR water; and 
the instruments, valves, pumps, and other 
auxiliary equipment required for the specified 
operations. 


With the exception of the in-pile tube, the 
system was designed to the ASME boiler and 
piping codes. A mock-up of the in-pile loop 
was proof-tested for endurance under con- 
ditions more severe than predicted for opera- 
tion. 


Instrumentation alarms and controls are de- 
scribed in some detail from the standpoint of 
protection against malfunctions or inadequacies 
of heat transfer and hydrauiic equipment, al- 
though no calculations are presented. Features 
for responding to other contingencies, including 
excessive radioactivity, are described in less 
detail. 


The shielding was designed for maintaining 
the radiation at the outer surface below the 
maximum permissible levels during normal 
operation of the test loop. An accidental re- 
lease of 1 per cent of the largest fuel specimen 
would result in a gamma-ray field of less than 
10 r/hr at the outer surfaces of the cubicle 
shielding. 








The maximum positive effect of nuclear 
coupling between experiment and reactor on 
5k/k would occur during insertion of fuel speci- 
mens and is predicted to be less than 1 per 
cent. Various hazards are listed, including 
pump failure, pump power failure (one pump to 
be connected to a failure-free circuit), flow- 
channel blockage, temperature rise resulting 
from increased heat generation or loss of 
cooling capacity, pressure rise resulting from 
malfunction of the pressurizer, pressure loss 
as from crack in a container, and rupture of 
test specimen cladding. However, meltdown 
or rupture of the in-pile pressure tube is not 
stated to be a hazard. If failure of this tube 
were credible, pressure protection for the 
annulus would be required. 

The maximum credible accident is considered 
to be a test specimen fracture that would re- 
lease 5 per cent of the activity from a 1.5-Mw 
test specimen to the circulating loop. It is 
predicted that an operator would receive no 
more than a quarterly integrated dose if he left 
the area adjacent to the shielding wall within 
10 min. A method of decontamination and/or 
removal of affected parts is described in 
which decontamination solutions, shielded casks, 
etc., are used. 

(I. T. Dudley, D. B. Trauger, and L. A. Mann) 


Fissionable Material 


Outside Reactors 


EDITORS’ NOTE: This section is comprised entirely of 
a paper prepared by the ANS Standards Project Subcom- 
mittee on Fissionable Material Outside Reactors and was 
presented by 4. C. Paxton, Los Alamos Scientific Labo- 
ratory, at the 1959 Annual Meeting of the American 
Nuclear Society. It is included in its entirety here, in- 
asmuch as it will not appear in the transactions of that 
meeting. 


Standards for criticality control must be 
based on firm criticality data, and such data 
are incomplete though accumulating. As a con- 
sequence, standards in this field must be a 
matter of successive approximations, at first 
incomplete, or a strange mixture of realism 
and extreme conservatism, afterward to be 
filled in as more information becomes available. 

The Nuclear Safety Guide,'® which presents 
the combined efforts of a number of persons 
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and organizations interested in this problem, 
is being considered for adoption as a standard 
by the American Standards Association (ASA), 
even though deficiencies are recognized, and 
revision is planned by an ASA subcommittee 
under the leadership of Frank Woitz of Good- 
year Atomic Corporation. A major difficulty 
is the selection of concise rules that are suf- 
ficiently general to be useful without having 
unnoted pitfalls. 

The manner in which tabulated limits of the 
concentration of fissionable materials listed in 
the Nuclear Safety Guide are obtained from 
experimental data is illustrated in Fig. 1. In 
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Figure 1—Critical masses of homogeneous water- 
moderated highly enriched uranium (93.2 per cent 
U5) spheres. @, direct spherical data. O, from cy- 
lindrical data, ~-j-_|_, from “‘hydride’’ data. Termi- 
nal slopes are from reactivity coefficient data. 


this case the mass limits blocked out are fer 
isolated, homogeneous, hydrogen- moderated 
u**> spheres with and without a water reflectcr, 
and they apply to cases where double-batching 
can be ruled out (note the limitations). The 
corresponding curves for Pu?*® and U?*? have 
much less experimental support. Other types 
of data, such as shape factors and density or 
dilution exponents, lead directly to limit in- 
creases where applicable. 

Limits for simple isolated systems are only 
a starting point, for isolation and simplicity 
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are seldom fovnd in a processing plant. The 
Guide, therefore, deals with intei action and re- 
duction of complex systems to conservatively 
equivalent cylinders or spheres. It also gives 
rules for storage and transportation. 
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Figure 2—Storage capacity of three-dimensional 
lattice. O, concrete-reflected lattice. 0, partially 
reflected lattice. O, unreflected lattice. (Data from 
é.T. Thomas and C, L. Schuske, LASL, are included.) 


1; Equivalent 20-kg, solid, highiy enriched uranium 
spheres 
2: Equivalent 32.kg, solid, highly enriched uranivm 
spheres 
3: 24.5-kg, solid, highly enriched uranium slabs, 1 x 
8 x 10 in. 
4: 30-kg assemblies of ~5-kg highly enriched ura- 
nium pieces with an effective density of 40 per 
cent 
5: Highly enriched UO,F, solution in 6-in.-diameter 
cylinders; hydrogen-to-U*™ ratio of 44 
6: Highly enriched UO,F, solution in 8-in.-diameter 
cylinders; hydrogen-to-U™ ratio of 44 
1: Highly enriched UO,F, in three 3-in.-thick, 47.5- 
in.-wide slabs of variable height; hydrogen-to-U”*5 
ratio of 337 

= Lattice-density exponent of the expression F°S, 
where F is the volume fraction of the lattice that 
is occupied by the indicated unit 
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The specific rules for storage and transpor- 
tation seem to be over-restrictive for materials 
of large critical volume, such as slightly en- 
riched uranium metal or dilute solutions. The 
rules were based on experimental arrays of 
small-volume metal units, and generalization 
to much larger units was believed at the time 
to be risky. Data row exist, some very crude, 
on a sufficient variety of lattices to test gen- 
eralizing schemes. 

For three-dimensional arrays of a ziven 
unit, it appears that the storgoe capacity of the 
lattice (say, in number of spherical critical 
masses of material) is proportional to *~‘, 
where Fis the volume-fraction of the lattice 
that is occupied by units and s is a constant 
that may be called the lattice-density exponent. 
The way in which s correlates with the reac- 
tivity index of a unit (in this case fraction of 
critical mass) ard with degree of reflection 
about the lattice is illustrated in Fig. 2 fora 
considerable variety of unit types. If this sort 
of correlation is consitered convincing, storage 
and transportation limits may be ¢cneralized 
therefrom immediately. 

The types of data that exist for linear and 
planar storage arrays are shown in Fig. 3. 
This is only one example of efforts to fill gaps 
in the potential standards for criticality control. 
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Figure 3— Linear and planar arrays of approximately 
32-kg highly enriched uranium spheres centered 8 in. 
above concrete floor in room with concrete walls. 
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Appendix: Notice of Proposed Rule Making* 


The Commission is considering the formulation 
of anamendment to its regulations tostate site cri- 
teria for evaluation of proposed sites for nuclear 
power and test reactors and is publishing for com- 
ment safety factors which might be a basis for the 
development of site criteria. 

In view of the complex nature of the environment, 
the wide variation in environmental conditions from 
one location to another and the variations in reactor 
characteristics and associated protection which can 
be engineered into a reactor facility, definite cri- 
teria for general application to the siting problems 
have not been set forth. 

All interested persons are invited to submit com- 
ments and suggestions on the following site factors 
and on development of definitive criteria for evalua- 
tion of sites for power and test reactors which might 
be incorporated in the Commission’s regulations. 
All interested persons who desire to submit written 
comments and suggestions should send them to the 
U. S. Atomic Energy Commission, Washington 25, 
D. C., Attention: Division of Licensing and Regula- 
tion, within 30 days after publication of this notice 
in the Federal Register. 


Factors Considered in Site Evaluation for Power 
and Test Reactors. a. General. The construction 
of a proposed power or test reactor facility at a 
proposed site will be approved if analysis of the site 
in relation to the hazards associated with the facil- 
ity gives reasonable assurance that the potential 
radioactive effluents therefrom, as a result of nor- 





*Reprinted from Federal Register, May 1959. 


mal operation or the occurrence of any credible 
accident, will not create undue hazard to the health 
and safety of the public. 

There are wide possible variations in reactor 
characteristics and protective aspects of such fa- 
cilities which affect the characteristics that other- 
wise might be required of the site. However, the 
following factors are used by the Commission as 
guides in the evaluation of sites for power and test 
reactors. The fact that a particular site may be 
deemed acceptable for a proposed reactor facility 
when evaluated in the early phases of the project, 
does not determine that the reactor will eventually 
be given operating approval, or indicate what limi- 
tations on operation may be imposed. Operating 
approvals depend on detailed review of design, con- 
struction and operating procedures at the final con- 
struction stages. 

b. Exclusion distance around power and test re- 
actors. Each power and test reactor should be 
surrounded by anexclusion area under the complete 
control of the licensee. The size of this exclusion 
area will depend upon many factors including among 
other things reactor power level, design features 
and containment, and site characteristics. The 
power level of the reactor alone does not determine 
the size of the exclusion area. For any power or 
test reactor, a minimum radius on the order of 
one-quarter mile will usually be found necessary. 
For large power reactors a minimum exclusion 
radius on the order of one-half to three-quarter 
miles may be required. Test reactors may require 
a larger exclusion area than power reactors of the 
same power. 
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c. Population density in surrounding areas, Power 
and testreactors should beso located that the popu- 
lation density in surrounding areas, outside the ex- 
clusion zone, is small. It is usually desirable that 
the reactor should be several miles distant from 
the nearest town or city and for large reactors a 
distance of 10 to 20 miles from large cities. Where 
there is a prevailing wind direction it is usually 
desirable to avoid locating a power or test reactor 
within several miles upwind from centers of popu- 
lation. Nearness of the reactor to air fields, arte- 
rial highways and factories is discouraged. 


d. Meteorological considerations. The site me- 
teorology is important in evaluating the degree of 
vulnerability of surrounding areas to the release of 
air-borne radioactivity to the environment. Capa- 
bilities of the atmosphere for diffusion and disper- 
sion of airborne release are considered in assess- 
ing the vulnerability to risk of the area surrounding 
the site. Thus a high probability of good diffusion 
considerations and a wind direction pattern away 
from vulnerable areas during periods of slow dif- 
fusion would enhance the suitability of the site. If 
the site is in a region noted for hurricanes or tor- 
nadoes, the design of the facility must include safe- 
guards which would prevent significant radioactivity 
releases should these events occur. 


e. Seismological considerations. The earthquake 
history of the area in which the reactor is to be 
located is important. The magnitude and frequency 
of seismic disturbances to be expected determine 
the specifications which must be met in design and 
construction of the facility and its protective com- 
ponents. A site should not be located on a fault. 


f, Hydrology and geology. The hydrology and 
geology of a site should be favorable for the man- 
agement of the liquid and solid effluents (including 
possible leaks from the process equipment). De- 
posits of relatively impermeable soils over ground 
water courses are desirable because they offer 
varying degrees of protection to the ground waters 
depending on the depth of the soils, their permea- 
bility, and their capacities for removing and retain- 
ing the noxious components of the effluents. The 
hydrology of the ground waters is important in as- 
sessing the effect that travel time may have on the 
contaminants which might accidentally reach them 
to the point of their nearest usage. Site drainage 
and surface water hydrology is important in deter- 
mining the vulnerability of surface water courses 
to radioactive contamination. The characteristics 
and usage of the water courses indicate the degree 
of risk involved and determine safety precautions 
that must be observed at the facility in effluent con- 
trol and management. The hydrology of the surface 
water course and its physical, chemical and biologi- 
cal characteristics are important factors in evalu- 
ating the degree of risk involved. 

g. Interrelation of factors, All of the factors de- 
scribed in paragraphs b through f of this section 
are interrelated and dictate in varying degrees the 
engineered protective devices for the particular 
nuclear facility under consideration, and the de- 
pendence which can be placed on such devices. It 
is necessary to analyze each of the environmental 
factors to ascertain the character of protection it 
might afford for operation of the proposed facility 
or the kind of restrictions it might impose on the 
proposed design and operation. 
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Simulator Studies 
of Reactor Accidents 


The analog computer, an effective tool for 
examining the dynamic behavior of complex 
and nonlinear systems, is especially useful in 
studying the effects of malfunctions of reactor 
control systems. The information obtained is 
most worth while if the studies are performed 
before the accident occurs in actual operation. 
Such analyses have been made to determine 
the severity of operational accidents postulated 
for two pressurized-water reactors. 

The effects of introducing cold water into the 
Shippingport Pressurized Water Reactor (PWR) 
by two different mechanisms were analyzed by 
d-c analog simulation todetermine the minimum 
conditions beyond which safety limits were 
exceeded.' The first case involved the shutdown 
of the coolant pump in one of, the four coolant 
loops which was then, through simulated “error,” 
restarted at full speed after a shutdown time 
of 2 min. The water would be approximately 
40°F below the average temperature of the 
coolant system and would thus subject sections 
of the reactor to a temperature change ata rate 
of 500° F/sec (based on known performance). 

The second case involved operation of three 
coolant loops at full reactor power, with the 
fourth loop having been refilled with 70° F water 
after maintenance. Through operator “error” 
and because of hydraulic valve interlock “fail- 
ure,’’ the cold loop was connected into the reac- 
tor coolant system and the pump was run to full 
speed. This sequence of events would also cause 
sections of the reactor to be subjected toa much 
faster rate of temperature change. 

The series of simulator calculations took into 
account inlet plenum mixing, hot-channel tem- 
perature deviation from the average tempera- 
ture, uncertainty in the sectional temperature 
coefficient of reactivity, transport effects on heat 
transfer, and the limit of simulation validity at 
inception of bulk boiling. The use of two values 
of the sectional values of the temperature coef- 
ficient of reactivity and of the consequences of 
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momentary overshoots of the blanket and core 
fuel temperatures produced variations in the 
coolant inlet temperature of 14 to 40°F, re- 
spectively. On the basis of the simulation results 
and metallurgical considerations of possible 
damage, a maximum allowable variation in the 
coolant inlet temperature of 20°F was chosen. 
The temperature factors that indicated this 
maximum were the blanket-fuel-rod UO,-pellet 
melting point and the transformation tempera- 
ture at which swelling of the uranium-zirconium 
alloy fuel plates would occur. 

The report! on these simulator studies pre- 
sents a comprehensive simulation and data 
analysis of a well-defined safety problem, but 
no control system design or operating procedure 
recommendations are made. (F. P. Green) 

A general purpose d-c analog computer was 
also used to determine the consequences of the 
loss of coolant flow in the pressurized-water 
reactor being built by the Yankee Atomic Electric 
Company, Rowe, Mass. However, unless the 
reader is skilled in computer use, he will find 
that the mechanics of carrying out the analyses 
are difficult to understand. In the report’ on this 
study the derivations of the equations used, as 
well as the nomenclature and some of the values 
of the parameters, are given in the appendixes. 
Since it is rarely possible ina study of a system 
as complex as this power plant to deal with all 
the physical phenomena which have a bearing on 
the problem under investigation, statement of 
the assumptions made is imperative. Some of 
the assumptions were necessitated by the limita- 
tions of the computer equipment. Others were 
made because of lack of experimental data in 
some areas. Since the basic assumptions and the 
conclusions constitute the major worth of the 
report,” both are quoted here, in part. 

The physical mechanism of the accident and the 
related thermal and neutron kinetics of the reactor 
core are as follows. As coolant flow decreases, the 
core outlet temperature increases and the film heat 
transfer coefficient decreases. This increase in 
average coolant temperatures causes a decrease in 
reactivity as a result of the negative tempera- 
ture coefficient of reactivity associated with the 
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moderator-coolant region. A decrease in reac- 
tivity causes a reduction of reactor power level. 
The specific power of the reactor, the fuel pellet 
diameter, and the fuel thermal conductivity are 
such that a high thermal gradient is established in 
the fuel when the reactor is at full power. Hence, 
the average fuel temperature is well above the 
average coolant temperature. When aloss of coolant 
flow occurs, this large amount of heat energy stored 
in the fuel tends to maintain a relatively high heat 
fiux at the moderator-clad interface while the film 
heat transfer coefficient is decreasing. These two 
effects result in a rapid approach to a burnout 
condition within some region of the core . 

This study deals with the transient behavior of 
the neutron and thermal kinetics of the core for the 
time interval after complete loss of coolant flow 
has occurred. System components external to the 
core such as the pressurizer and steam generator 
are not included in the study. All physical prop- 
erties of the core materials were assumed to be 
constant and, consequently, the data presented in 
this report have full significance only before the 
time at which bulk boiling occurs. This temperature 
dependence has been omitted because of the lack of 
knowledge of the flow behavior during bulk boiling. 
A further limitation on the results arises from the 
fact that consideration of both flow redistribution 
and the effect of voids on the neutron kinetics was 
omitted.... 

The assumption was [also] made that no thermal 
damage to the reactor core would be experienced if 
no bulk boiling occurred at the outlet of the core 
hot channel at any time during the accident. The 
elapsed time at which [boiling] occurred is also of 
importance since the heat flux at the surface of the 
clad has decreased with time. The longer the time 
required to reach bulk boiling, the lower the maxi- 
mum heat flux and the less the likelihood that burn- 
out would occur. The time to reach bulk boiling 
is thus an additional criterion for evaluation of 
results... . 

The results obtained from this study show that 
for the 392-Mw(t) Yankee core with complete loss of 
coolant flow, bulk boiling occurred at the outlet of 
the hot channel approximately one second after the 
initiation of the accident for the condition of the 
instantaneous scram. As a result of the relatively 
low thermal conductivity and the large heat storage 
of the fuel material, the effect upon the outlet tem- 
perature caused by scramming the reactor is 
negligible for this initial portion of the transient. 
When stored mechanical energy is added to the 
primary loop, the flow decay rate is slower with 
the result that the increase in hot channel tem- 
perature is also much slower. Whe. the reactor is 
scrammed, the increase in hot channel temperature 
can be kept below the bulk boiling point provided, 
of course, that sufficient energy has been added to 
the system. 


Addition of mechanical energy to the loop 
might be in the form of increased pump inertia. 
Practical considerations for storing such me- 
chanical energy undoubtedly would provide the 
limitation t)> this attempted solution of the 
problem of bulk boiling on simultaneous loss 
of all pumps. 

The assumption that all four pumps could stop 
simultaneously in this power plant easily pro- 
vokes arguments over how safe to make a reac- 
tor. Justification of the assumption was not an 
object of the analysis, but a decision must have 
been made regarding maximum safety since no 
mention was made of a situation in which the 
safety system was assumed to be inoperative 
during the pump failure transient. Failure of the 
safety system when needed is probably an un- 
likely event, and, yet, establishment of three 
independent power supplies for the four primary 
coolant system pumps is a feature of the safety 
system. Evaluation of the safety of a nuclear- 
power plant involves evaluation of the safety 
provided by each feature. Itis therefore difficult 
to understand why this one feature of the safety 
system can be thought of as failing when, at the 
same time, little concern is shown over the 
failure of the scram system. (E. R. Mann) 


Analysis of Reactor Transients 


Several recent studies of reactor kinetics 
include observations of the pressure and tem- 
perature of a small homogeneous system follow- 
ing a rapid reactivity increase;*’! a stability 
analysis of a large test reactor, the ETR, with 
reactivity feedback through the temperature 
coefficient;’ a correlation of data from power- 
burst experiments on five different reactors;° 
and studies of the thermal-transient behavior in 
both the PWR anda hypothetical water reactor."’® 
In many instances the effect of the temperature 
coefficient and/or void formation has been shown 
to limit the reactor excursion and to thus pre- 
vent an accident. General agreement has been 
found among the results of several transient 
experiments and the results of calculations 
based on simple analytical models. 

As a part of the Kinetic Experiments on Water 
Boilers (KEWB) program, experimental results 
have been obtained for small, aqueous homoge- 
neous reactors and reported by Stitt and others® 
of Atomics International. The reactor consisted 
of a 12'/4-in.-diameter stainless-steel sphere 
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(0.22-in. wall) having a capacity of 13.6 liters 
(exclusive of neck), surrounded by a 54-in. cube 
of graphite. Reactivity was introduced suddenly 
by rapid withdrawal of a centrally located poison 
rod. A record was made of power level, pres- 
sures at the bottom of the core and in the gas 
space above the free surface of the liquid, and 
temperature in the liquid, with the fuel solution 
(11.5 liters of uranyl sulfate) initially at a tem- 
perature of 25°C anda pressure of 15 mm Hg. 
The injection of 4 per cent reactivity resulted 
in a stable period of 2 msec. About 4 Mw-sec of 
energy was released as the fuel solution ex- 
panded, with the peak power being 530 Mw; the 
pressure at the top of the core peaked at 370 psi 
at 3.9 msec after the peak power was reached. 
Experiments started at initial pressures of 
either 43 or 71 mm Hg resulted in peak powers 
about 50 per cent greater than those observed 
at 15 mm Hg; higher initial temperatures re- 
sulted in correspondingly lower peak powers. 


In further studies of water-boiler reactor 
excursions, Hetrick‘ reports that the pressure 
rise is about three times larger when the core 
is initially full of liquidfuel; and, also, that when 
the reactivity is added linearly in time, the peak 
pressure correlates well with the minimum 
period observed and agrees with the pressure- 
period correlation of Stitt and others.’ Using 
this information, Hetrick concluded that the 
peak pressure occurring in the Armour Research 
Reactor after sudden insertion of 2.5 per cent 
reactivity would not rise above 300 psi. 

(L. G. Alexander) 


The stability of the ETR was examined by 
Gossman,° primarily to investigate its stability 
at full power (175 Mw) under design conditions. 
Measurements were made of feedback-frequency 
response, open-loop response, and closed-loop 
response; the responses were analyzed for 
stability by the Nyquist criterion. Inthe analysis 
it was considered that cooling water passed 
through the reactor core and then through the 
primary side of a heat exchanger and re- 
entered the core. The temperature of the pri- 
mary cooling water leaving the heat exchanger 
was used to control the coolant flow through the 
secondary side of the heat exchanger. The 
secondary coolant-flow— control system charac- 
teristics were based on experimental measure- 
ments.® The core and the heat exchanger were 
essentially considered to be “point” quantities 
(zero transit times). 


An average negative temperature coefficient 
of reactivity was considered for the core, with 
the average core temperature being the linear 
average of the core-inlet and core-outlet tem- 
peratures. Since the core-coolant transit time 
was short, consideration of point values for the 
core should be valid. Inside the core, heat 
transfer from the fuel element to the coolant 
was considered by taking into account energy 
accumulation within the fuel element and the 
energy transfer from the element to the fluid. 
Since the heat-transfer coefficient associated 
with energy transfer from fuel element to coolant 
was high, 9000 Btu/(hr)(sq ft)(°F), the relation 
between the fuel element temperature and the 
coolant temperature under equilibrium con- 
ditions may have been sufficient rather than the 
time-dependent relation that was used. In the 
heat exchanger, heat transfer was based on the 
linear average of inlet and outlet temperatures. 
Since the transit time in the heat exchanger 
would be significant, a better mathematical 
representation of the heat exchanger would be 
warranted if the heat-exchanger behavior were 
found to influence the results. The conventional 
linearized reactor kinetic equations were used 
to relate reactor power to reactivity; six 
delayed-neutron precursors were considered. 

The ETR was found to have a high degree of 
stability on the basis of its negative tempera- 
ture coefficient of reactivity. The temperature- 
activated controller for effecting changes in 
secondary coolant flow was, however, found to 
be ineffective. Because of the slow response 
associated with the heat exchanger, it is doubtful 
whether stability can be significantly affected by 
secondary coolant-flow control except at very 
low frequencies. (P. R. Kasten) 

Power-burst experiment data from SPERT, 
KEWB, BEPO, BORAX, and GODIVA have been 
well correlated by Corben, * who shows that some 
of the behavior observed may be derived theo- 
retically by an analysis that does not make any 
reference to the shut-off mechanism and, in 
some cases, is indifferent to the details of the 
reactor kinetic equations. Corben predicts that 
in excursions having a period 7 less than 10 
msec, the maximum power P,, is, to a good 
first approximation, equal to 


1 
3 P, exp (t,,/7) 


where Po is the initial power, and /,,is the time 
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elapsing between insertion of reactivity and at- 
tainment of maximum power. Using this relation, 
he obtains three others, namely, 


TPm =: E(tm) 


where E(/»,) is the integrated energy release at 
time tm; 


Etot = 2Py, 


where Et, is the total energy released in the 
excursion; and 


B =1.767T 


where B is the burst width (at half-maximum 
power) in milliseconds. These approximate 
relations correlate the available data with con- 
siderable success. 

Wieczorkowski’ has studied thermal-transient 
behavior in the PWR (both at power and in the 
shutdown conditions) by means of an analog 
computer. Variables included were coolant-flow 
rates, inlet temperature, initial power level, rod 
worth, and withdrawal rates. The results were 
presented in the form of plots of peak power, 
peak coolant temperature andpressure, peak hot 
channel temperature, and coolant volume surge. 
Typical “worst case” results are shown in 
Table I-1. 

Burnout occurs when the burnout ratio falls 
below 1.5. It was concluded that the reactor was 
safe from burnout for the transients studied and 
that boiling in the core would not occur. The 
greatest danger was felt to arise from large 
volume surges that might occur when the reactor 


was Started up with the coolant temperature and 
pressure below normal for operation. The 
resulting pressure surge might damage the 
system before the pilot-operated relief valve 
opened. (L. G. Alexander) 

A widely used method for specifying the de- 
gree of safety of a reactor is to investigate the 
behavior of the system following a sudden intro- 
duction of 2 per cent excess prompt reactivity. 
The relevance of this behavior to the question of 
safety is somewhat doubtful, but, at least, a well- 
defined problem is presented. In a paper by 
Golian and others,” an attempt is made togive a 
rather complete discussion of the problem of 
temperature distribution during such an excur- 
sion within a reactor core’ which consists of 
alternate fuel, cladding, and coolant regions 
bounded by parallel planes. This is not an unduly 
idealized geometry since, as they point out, for 
the short period involved in the safety calcula- 
tion, coolant motion is unimportant. Most exist- 
ing and proposed fuel elements are assemblies 
of plates. 

More specifically, a repeating structure is 
assumed that is characterized by a fuel, cladding, 
and coolant thickness. It is assumed that the 
heat from the source increases exponentially 
with time and is constant within the fuel regions. 
Starting transients are largely ignored, as is 
the departure from exponential behavior finally 
produced by shutdown, the latter consideration 
being completely in the spirit of the usual safety 
calculation. A reasonable fuel alloy is assumed 
in a single thickness. Three claddings are con- 
sidered (aluminum, stainless steel, and zirco- 
nium), each in three thicknesses. The coolant 
is water and is assumed infinite, which should 
introduce little error. 


Table I-1 WORST CASE TRANSIENTS IN PWR 
(Data taken from reference 7) 





Rod withdrawal 
during power 


Cause of transient 


Startup on four loops 
with pumps at full speed 


Startup on three loops 
with pumps at half speed 





Start-up rate 


Reactivity inserted 15 x 107! dk 
Initial power, % 100 

Initial average coolant temperature, °F 523 

Initial pressure, psia 2000 

Peak power, % 125 

Peak hot channel temperature, °F 606.5 
Pressure at peak power, psia 2080 
Saturation temperature at peak power, °F 639 

Burnout ratio at peak power 2.28 


25 decades of 25 decades of 


power/min power/min 

1 1 

250 . 250 

400 400 

160 : 74 

375 425 

511 469 

469 460 

2.25 2.3 
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Considerable detailed information was cal- 
culated on the important aspects of the tem- 
perature distribution for periods up to about 
20 msec. ‘p to the time when boiling occurs, 
the calculations are straightforward, although 
laborious, and results are given for the peak 
fuel temperature when the coolant reaches boil- 
ing. On the assumption that shutdown is achieved 
by void formation, calculations are given for 
the peak power and the peak fuel temperature 
under various conditions. A considerably simpli- 
fied assumption has been made for the heat con- 
duction across the vapor film, but comparisons 
between calculated and measured peak power 
versus period and degree of subcooling for the 
BORAX experiments seem to justify the pro- 
cedure used. (T. A. Welton) 


Collapse of Parallel-plate 
Fuel Assemblies 


Theoretical relations have been derived which 
are suitable for the approximate prediction of 
critical coolant-flow velocities for collapse of 
long, uniformly curved, parallel-plate fuel as- 
semblies in the ETR.® At the critical velocity, 
modifications of the local linear velocity re- 
sulting from plate deflection produce a pressure 
differential sufficient to maintain the deflection. 
Important assumptions on which the analyses are 
based include uniform flow of anincompressible 
coolant, zero inter-channel leakage, and rigid 
side plates or supports. The results of the study 
are summarized as follows: 

CASE A. Critical coolant flow velocity, V,, 
for flat plates with fixed edges 


Kap 12 
eet (1) 


Y= 

‘ Fs (-v 

If the fuel meat is assumed to have no shear or 
bending stiffness, Eq. 1 becomes 


_ [30 gen ]? (2) 
© * |pot (1 - v’) 

CASE B. Fiat plates with simply supported 
edges 


y. -|Sgza%_]" 
€ [2 pb" (1-7) 


(3) 


CASE C. Flat plates with simple supports 
spaced longitudinally (at intervals long in com- 
parison with plate width) 








l, 
4 3 2 
_ |_a gEa*h 
— ‘é pl? ti- | . 


Equation 4 gives the lowest critical velocity 
corresponding tothe simplest mode of deflection. 

CASE D, Curved plates with fixed edges (for 
a << R) 














2 gEa’h B, sin’ w 
ae (eA 2» /1__sin2@ cos 2a 
3pb a-Af- i (5) 
where /y = (AR*4/I) fo(a) + fi(a) 


f(a) = 2a + sin 20/8 sin’ a 


fy(a@) = fila) — 1/20 


CASE E. Curved plates with hinged edges 





(8) 


—_— 4gEa*hp, sin® a)” 
c | 8ppt(1—- *)C 





where , =(AR?/I) fs(a) +F4(a) 
f3(a) = (ss a . Be. cBa cos 2a 


f(a) = 2a + sin 20/8 sin’ a 


& a eee 2a (§ cot a-a) 
3 4 


- = cos 2a +a cot a(1- cos 22) 


In these expressions 


a = plate thickness 

b = width of flat plate or chord of curved plate 

g = gravitational acceleration 

h = initial flow-channel thickness at midspan 

7=moment of inertia of beam cross section 
per unit beam width 

1 = longitudinal distance between plate-edge 
supports 

E = Young’s modulus of elasticity 
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a = one-half of angle subtended by a curved-plate 
arc between supports 

v = Poisson’s ratio 

p = weight density of coolant 

A=area of beam cross section per unit beam 
width 

R = initial mean radius of curvature of acurved 
plate i 

t.= clad thickness on each surface 


It is pointed out that membrane compressive 
stresses will decrease V; to below the calcu- 
lated value. Such a transverse loading could 
arise if the pressure on the exterior of the side 
plates exceeded the pressure in the channels 
between fuel pilates. Conversely, transverse 
tensile loads on all plates would increase V; to 
above the calculated value. Further uncertainties 
which could cause the actual V, to differ from 
the calculated V, include deviation of channel 
geometry parameters from nominal values, 
thermai stresses in regions of large tempera- 
ture gradients, and possible modes of creep 
collapse arising from alteration of fuel-plate 
mechanical properties due to irradiation. 

Flow tests should, accordingly, be conducted at 
velocities significantly greater than the design 
value for determination of the safety margin 
available. In particular, some allowance must be 
made for deleterious in-pile conditions, suchas 
fuel burn-up. 

In some fuel-plate assemblies, collapse has 
occurred at one-half the calculated critical 
velocity. For the ETR, for example, the cal- 
culated critical velocity with cold water is 
54 ft/sec; but the actual average velocity at 
which fuel plates buckled in room-temperature 
tests, as reported by Beck and others,'° was as 
low as 29 ft/sec. This result is attributable in 
part to deviations from initial nominal geometry 
and in part to a 20 to 25 per cent velocity dif- 
ference between instrumented channels. Further 
discrepancies between ETR design values and 
experimental results have been noted!® in ex- 
periments in which 10 of 930 fuel-element 
coolant channels and 16 of 256 control-rod 
coolant channels were instrumented. The core 
pressure drop required to establish an average 
coolant velocity of 35 ft/sec in the fuel-element 
coolant channels was 55 psi, whichis tobe com- 
pared with a design value of 42 psi; the pressure 
drop required for the same velocity in the 
control-rod coolant channels was 64 psi, which 
is to be compared with a design value of 42 psi. 


The ETR fuel-plate collapse velocity was in- 
creased substantially by vertically slotting the 
side plates to equalize lateral pressure differ- 
ences; these modified assemblies did not buckle 
at an average velocity of 39 ft/sec. A report 
containing detailed results of these tests has been 
issued." (W. R. Gambill) 


Leak in the Homogeneous Reactor 
Test Core Tank 


On Apr. 4, 1958, following runs in which a 
total of 390 Mw-hr of thermal energy was 
generated, the fuel solution of the Homogeneous 
Reactor Test (HRT) was detected in the blanket 
region. A long narrow horizontal hole with a 
flow area of approximately 1.5 sq in. was found 
near the bottom of the core close tothe junction 
of the 30 and 90 deg conical entrance sections, ” 
and, in addition, a sample holder inthe core was 
similarly damaged. The holes in the HRT core 
tank and sample holder appear to have been 
caused by metal temperatures above the melting 
point; the possibility that the holes resulted from 
corrosion or chemical reaction is inconsistent 
with the available information. Since simple 
heat-transfer considerations alone indicate that 
the melting point could not be attained without 
uranium deposition, estimates were made of the 
magnitude of uranium deposition required to melt 
a hole in the core tank. 


In the subsequent analysis of the formation of 
the leak,'® the physical model assumed that a 
uranium-bearing scale was deposited on the 
core-side surface of the core tank. Fissioning 
of this uranium generated heat that was trans- 
ferred by conduction through the scale into the 
core fluid and through the core tank wall into the 
blanket fluid. The conditions under which melting 
of the zirconium core tank could take place were 
obtained by mathematically solving the appro- 
priate heat-conduction problem. In estimating 
the surface temperatures of the scale and wall 
(blanket side), it was assumed that subcooled 
nucleate boiling tcok place, a condition that 
permits a good estimate of the surface tempera- 
ture. If the heat flux exceeds that removable by 
nucleate boiling, the surface temperature could 
rise and film boiling could occur, which could 
lead to burnout at lower values of uranium 
deposition than estimated. No attempt was made 
to analyze flow conditions in the vicinity of the 
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hole or to postulate mechanisms of uranium 
deposition. 

The maximum temperature of the core tank 
would occur at the wall-scale interface. It was 
assumed that when the interface temperature 
reached the melting point the condition existed 
for formation of a hole inthe wall. The thickness 
of uranium-bearing scale required to raise the 
wall-scale interface to the melting point was 
calculated as a function of U’** density and 
effective diameter of the deposit. The results 
(for a 6-Mw operation) indicate that uranium 
deposits of relatively small area and thickness 
could result in melting of the tank wall. For 
example, a 1-in.-diameter deposit containing 1 g 
of U’*® per cubic centimeter of scale need be 
only 100 mils thick to cause a spot on the wall 
to reach the melting point. With higher uranium 
concentrations the required scale thicknesses 
were from 30 to 60 mils. 

The analysis considered the situation at the 
core wall. The same reasoning, however, applies 
to the sample holder and screens, and similar 
results are to be expected. Because of the many 
assumptions, the results should be considered 
only order-of-magnitude estimates. The esti- 
mates are of value from a qualitative viewpoint; 
that is, the estimated thicknesses of uranium 
deposits required to cause melting are small 
enough to seem possible and the required area 
is surprisingly small. These results emphasize 
clearly the danger associated with uranium depo- 
sition in areas of high neutron flux. 

(H. C. Claiborne) 
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Reactor Fuses 


Control of a nuclear reactor is normally effected 
by the control rods which are motivated by sig- 
nals from both the reactor control system and 
the reactor shutdown system. Although the con- 
trol and shutdown systems normally operate with 
independent instruments and electronic equip- 
ment, the control rods in the reactor are fre- 
quently common to both systems. Thus failure of 
the control rods to insert (as would be possible 
in some instances because of thermal distortion 
of the core) would result in the loss not only of 
control but of shutdown capacity. In situations 
where such failure is deemed at all likely, 
another completely independent shutdown mech- 
anism is provided. Such emergency shutdown 
systems may be divided into two classes, de- 
pending upon the provisions and occasions for in- 
troducing poison into the reactor. Pressurized- 
water reactors are commonly provided with 
means of adding boric acid to the primary cool- 
ant at the operator’s discretion, whereas in other 
systems the poison addition system is fused so 
that the poison is automatically inserted into the 
reactor by some phenomenon associated with a 
reactor excursion. In consideration of the possi- 
bility that the over-all safety of a reactor might 
be enhanced by this latter type of device, con- 
siderable work has been done in recent years on 
different types of fuses. 

Fuse tests conducted in the BORAX reactor 
are described in a report by Stilwell and Water- 
field.! The fuse consists of a chamber containing 
helium under pressure that is separated from a 
container of powdered boron by a fission-heated, 
fusible rupture disk. The geometry of the fuse is 
such that expansion of the helium through the 
rupture disk will carry the boron powder into an 
annular space surrounding a fuel element in the 
reactor. A summary of the results which show 
reactor behavior with and without the fuse is 
presented in Table III-1. 

Data on heat transfer and heat generation in 
fuse disks composed of a mixture of UO, ina 
lead-bismuth eutectic called “Cerrotru” were 


Table III-1 RESULTS OF FUSE TESTS IN 
THE BORAX REACTOR! 





Time to Total energy 


Reactor Max. reach max. released up to 





period, power, power, max. power, 
Condition msec Mw msec mw-sec 
Without fuse 23.9 240 310 12.61 
With fuse* 23.9 170 295 7.75 
Without fuse 14.6 470 280 15.52 
With fuse* 14.6 320 257.5 8.06 





*Data for behavior with the fuse were estimated from the 
rupture-disk release time, and laboratory test data which 
show that 15 msec is required to insert the poison following 
rupture. 


calculated. A strain-rupture curve was pre- 
pared, but the temperature at which the data 
were taken is not shown in the report. 

Triggers for igniting a gunpowder propellant 
to insert boron powder into a reactor have also 
been studied at General Electric.’ Three types 
of triggers were examined: fusible rupture disks, 
bimetallic elements, and explosives consisting of 
u**> embedded in diazodinitrophenol. 

The fusible disks were similar to those de- 
scribed above. The bimetallic elements were 
composed of uranium with mild steel and ura- 
nium with zirconium. Both straight and helical 
units were tested. The straight elements were 
arranged to provide overcenter snap action. Bi- 
metal action was considered to be completed 
when an electrical contact was made. The 
straight bimetallic element with snap action gave 
superior performance, and tests showed thai it 
operated from 52 to 81 msec before peak power 
was reached by the SPERT-I reactor on an 18- 
msec period. The report’ includes a thermo- 
elastic analysis of bimetal action anda descrip- 
tion of the instrumentation used. 

The developmental and experimental work 
carried on from 1954 to 1956 on three types of 
propellants used for insertion of nuclear poison 
(boron powder) into a reactor has been described 
by Spera, Stilwell, and Weiss.’ These propellants 
were compressed helium, explosive gas (hydro- 
gen or propane with air or oxygen), and solid 
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propellants (smokeless powder). Test setup pro- 
vided a thin annular chamber into which the 
boron powder was propelled which was similar 
to the chamber used in the fuse test in the 
BORAX reactor.' Velocities from 50 to 975 ft/ 
sec were reported. Different configurations of 
propellant and boron were investigated, and 
various annular volumes were used in the tests. 
Some tests in which explosive charges were 
used to provide directed propulsion to insert 
poison into a reactor are discussed in another 
General Electric report.‘ The authors, Donaven, 
Stilwell, and Stuart, report that shaped charges 
in which the nuclear poison forms the liner will 
develop velocities of 6 to 20 km/sec. They state 
that a “shotgun” type of propellant system will 
insert poison into a reactor in lessthan5 msec. 
These tests were intended to demonstrate and 
test a method of safely inserting poison. No de- 
sign was proposed, and hence no conclusions 
with respect to reactor safety and operation can 
be drawn. Similarly, athorough study of transient 
heat flow in the Atomics International Mark-II 
Reactor safety device, including both experi- 
mental and analytical work, has been described 
by Springer and Miller, >but no direct conclusions 
affecting reactor safety can be drawn from their 
study. 
A fuse that is sensitive to power level has been 
described by Fitch and Springer.® This fuse, 
which was triggered by the fission-induced melt- 
ing of a soldered plug or diaphragm which re- 
tains helium at 600 psi, was tested in SPERT-I. 
The release of helium pressure inturn released 
boron trifluoride at 1200 psi, that is, the device 
depended on the series operation of a fusible 
diaphragm and a rupture disk; it was calleda 
“double-diaphragm” safety device. The device 
was self-contained and occupied the same volume 
as a standard SPERT-I ¢lement. The reactivity 
loss produced in the central region of the core 
was considerable. It is not clear whether the de- 
vice that was tested represented the geometry 
required in a final design or whether it was de- 
developmental and peculiar to these particular 
tests. The tests amply demonstrated that under 
SPERT-I conditions the device was effective in 
removing the reactivity in excess of prompt 
critical as required to reverse transients inthe 
10-msec-period region. Use of the device also 
reduced the energy release and the peak power by 
factors of 10 and 25, respectively, in comparison 
with self-shutdown without the fuse. The tests 
also gave data in good agreement with calcula- 


tions of thermal characteristics and with labora- 
tory tests of poison release time, in which ap- 
proximately 0.003 sec was observed as the time 
required, after fuse trip, for 50 per cent release 
of the boron. One fuse failed to function during a 
test because of improper assembly. 

A major portion of the effort has been expended 
on the development of specific items necessary 
for a complete fuse assembly, and therefore no 
over-all conclusions as to the effect of fuses on 
nuclear safety canbe drawn. Where tests of com- 
plete fuses are reported, they appear to be of a 
developmental nature, and many ofthe questions 
that would arise in assessing the merit of a 
particular fuse design interms of over-all reac- 
tor safety and operation are not discussed. More 
information is needed in the following areas: 


1. Statistical variations and tolerances to be 
expected in such devices. 

2. Stress-rupture as affected by time andtem- 
perature where materials exhibiting these char- 
acteristics are used incritical fuse components. 

3. Methods of nondestructive testing which 
will ensure that the device will operate as de- 
signed. 

4. The general safety problem that is created 
when any device containing a void or potential 
void is inserted into a reactor. 


The latter problem is aggravated when the void 
is a pressure vessel and when the untriggered 
device represents a large contribution to nega- 
tive reactivity in the core. 

The behavior of the devices at reactor periods 
of less than 10 msec must also be investigated. 
Most fuse operation is predicated onthe integra- 
tion of energy during a transient. As transient 
periods decrease, integrated energy decreases 
for a given rise in power. Aregionof particular 
interest is that. of fuse operation in situations 
where the periods are shorter than 10 msec. 

(J. R. Tallackson) 


Reactor Safety System 
Design Criteria 


EDITORS’ NOTE: This section is comprised entirely of 
a paper prepared by Frank Larin, A. B. VanRennes, and 
Richard Olsen of the ANS Standards Project Subcom- 
mittee on Reactor Dynamic System Design and was pre- 
sented by Mr. Larin at the 1959 Annual Meeting of the 
American Nuclear Society. It is included in its entirety 
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here, inasmuch as it will not appear in the transactions 
of that meeting. 


’ 


The term “reactor safety system,” as used 
here, means the neutron detectors, instrumenta- 
tion, and reactor shutdown mechanisms required 
to measure reactor neutron-flux levels (and, 
generally, the time rate of change of the neutron 
flux), to determine whether the flux indications 
have exceeded selected trip levels, and to cause 
appropriate corrective action when the trip lev- 
els have been exceeded. * 

The purpose of this report is to present a check 
list of design practices recommended for incor- 
poration in reactor safety systems to give as- 
surance of reliable operation even with failure 
of some portions of the system. The list is in- 
tended primarily as an aid to reactor designers 
and users when designing or purchasing equip- 
ment and for evaluation groups who have heard 
the term “fail safe” so often for somany differ- 
ent types of equipment that it no longer has a 
concrete meaning. The concern here is withde- 
sign concepts. Many important performance re- 
quirements such as accuracy, response time, 
stability, reactivity insertion rates, and allowa- 
ble excess reactivities will not be considered 
here since they fall outside the scope of this re- 
port. 

In discussing failures inareactor safety sys- 
tem, a temptation exists to simplify the problem 
by stating merely that a design should provide 
for reactor shutdown whenever a component 
fails, that is, by “failure-to-safety” or fail-safe 
design. In practice, it is not always possible to 
obtain the same output response for all cate- 
gories of circuit or component malfunction (open 
circuits, short circuits, or grounds), or for 
changes in circuit parameters such as gain, re- 
sistance, capacitance, etc. 

Furthermore, absolute failure-to-safety may 
not always be desirable, for two reasons. First, 
failure-to-safety for all component failures 
could cause serious inconvenience from inad- 
vertent shutdowns. It may be preferable to sound 
an alarm and indicate the instrument malfunc- 
tion. The second reason is psychological and 
Closely related to the first. If the design is in- 
ferior but incorporates fail-safe features which 
Cause a large number of unnecessary shutdowns, 





*Although Mr. Larin stated orally that his paper 
referred specifically toswimming-pool type reactors, 
his analysis is applicable to other reactors. 


operating personnel may alter the equipment to 
keep the reactor in operation and compromise 
safe operation. Any equipment that can cause 
operator frustration is potentially dangerous. 
Fortunately, there are design methods which can 
alloy equipment failures without weakening the 
reactor integrity or shutting the reactor down. 

Four primary methods are available in various 
combinations to assure reactor shutdown when 
necessary, and which can, at the sametime, re- 
duce the probability of inadvertent reactor shut- 
down. These design features are: 


1. Fail-safe designs. . 

2. Use of monitoring and test circuits. 

3. Use of redundancy in the form of identical 
parallel signal channels and coincidence circuits 
for comparison between these channels. 

4. Use of highly reliable components. 


Failure-to-safety should be exploited in prudent 
design of control circuits so that the most proba- 
ble failures cause the output to indicate an ab- 
normal condition. Often such design is accom- 
plished by operating critical points off ground so 
that loss of power, shorts to ground, or open 
circuits will cause an abnormal signal. In other 
cases, current and voltage biases necessary to 
give a normal signal are obtained from the power 
supply through series connections which check 
circuit continuity. In any case, the design should 
attempt first to eliminate as many causes of 
failure as possible and, second, to give the 
proper abnormal response tothe most important 
component failures. 

Monitoring may be used to determine the 
proper operation of portions of control circuits. 
Such practices include continuous checking of 
voltages, currents, connections, superimposed 
a-c signals, outputs of other parallel circuits, 
etc. These check circuits should be as simple 
and reliable as possible. Careful thought should 
be given to the proper action desired in response 
to an indication of failure. Some of these alterna- 
tives will be discussed later. 

In addition to monitoring, test signals may be 
introduced into the equipment to check for proper 
operation or for calibration. These may be de- 
veloped by elaborate automatic test equipment or 
manually by simple voltage or current sources. 
Again, reliability of the test equipment is im- 
portant; poor test equipment can create more 
troubles than it locates. 

Redundancy is the combining of independent 
channels which measure the same variable and 
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initiate a common response, and it should always 
be used whenever a failure of one circuit might 
create a dangerous situation. Ultimately these 
redundant signals are combined at a common 
point or junction of the channels to create the de- 
sired output response. For maximum reliability, 
this common point should be located as far 
toward the response end of the system as possi- 
ble so that the number of components common to 
all signal paths is minimized. 

Two systems for joining channels are in use; 
in one system an excessive signal, or trip signal, 
from any channel will cause a safety response, 
and, in the other, trip signals are requiredfrom 
two or more channels to effect a safety response. 
The latter system, usually called a coincidence 
system, is inherently a digital function. There- 
fore, in each channel, threshold or bistable cir- 
cuits must precede the common point of coinci- 
dence comparator to decide whether or not each 
signal is excessive. Besides preventing unneces- 
sary scrams, a coincidence circuit has the ad- 
vantage of permitting test of individual channels 
or trip circuits during operation without reactor 
shutdown. 

The former system, in which any channel can 
cause a response, may inject either analog or 
digital signals at the common point. In sucha 
system, the combining of analog signals so that 
the larger governs has in the past been termed 
“auctioneering.” 

The auctioneering function for analog signals 
is logically somewhat similar to a digital “OR” 
gate, which generates an output response when- 
ever a signal is delivered to any of its inputs. 

Combinations of fail-safe techniques with re- 
dundant and coincident measuring channels can 
be highly effective in providing reliable reactor 
control. 

The use of circuit components designed for 
highly reliable operation and the application 
of conservative engineering design practices 
greatly increases the reliability of reactor- 
contro! systems. Improved long-lived vacuum 
tubes are now available for a large number 
of applications. Magnetic amplifiers are used 
where moderate speed of response and sensi- 
tivity are required and where waveform is not 
important. Transistor and diode reliability has 
been increased to the extent that their integrity 
now approaches that of passive circuit compo- 
nents. The use of such reliable components is 
paying dividends in reducing the requirements 
of monitoring, testing, failure-to-safety, and 


redundancy, and is thus decreasing equipment 
complexity. Simplicity of equipment further in- 
creases reliability. 

The techniques used in reliable circuit design 
have been examined thus far; now, and more 
specifically, some criteria that may be used to 
evaluate a particular design will be presented. 
The criteria pertain primarily to power-level 
safety channels since most reactors require this 
protection for safe operation. However, they are 
also applicable in general to other information 
channels (that is, period, power derivative, tem- 
perature, pressure, etc.) that are necessary for 
safe operation. Necessary here means that fail- 
ure to shut the reactor down when the variable 
exceeds selected limits could cause serious 
damage and not merely minor damage or in- 
convenience. 

Since a reactor may be protected by a number 
of instrument arrangements, an instrument mal- 
function need not require the same action in 
every design. A general minimum rule will help 
clarify the action necessary for various failures: 
At least two independent channels which are 
necessary for safe operation must be fully opera- 
tive or the reactor should be shut down. 

In the criteria listed below, the term “trip the 
channel” may have a different meaning depending 
on the arrangement of independent channels and 
the application of the general rule requiring two 
operative channels. If there are two power-level 
safety channels, it means scram. If more than 
two channels are arranged in coincidence, the 
defective channel only is put in a condition call- 
ing for a scram. If there are more than two 
channels in a redundant arrangement, then it 
means that the circuit shall be interlocked to 
cause a scram whenever additional channel trips 
leave fewer than two operative channels. 

A list of suggested criteria for reactor con- 
trol systems follows: 

1. At least two independent channels which are 
necessary for safe operation must be operative 
at all times. 

2. There should be nounnecessary units com- 
mon to independent channels. 

3. Loss of ion-chamber supply power should 
trip the channel. 

4. Loss of instrumentation power should trip 
the channel. 

5. Loss of continuity of the interconnecting 
cables should trip the channel. 

6. Disconnection of any component of an inde- 
pendent channel should trip the channel. 
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7. Open circuits, short circuits, and grounds 
in the electronic equipment should, where possi- 
ble, trip the malfunctioning channel. 

8. Means shouldbe provided to indicate proper 
operation of the channel, including monitoring of 
operating conditions, insertion of test signals, 
detection of a-c signals imposed on the ion- 
chamber output, detection of minimum ion- 
chamber currents, etc. 

9. Safety rods should not scram against 
gravity. 

10. Safety rods should be designed so that no 
malfunction can permit the control rod to drop 
through the reactor core. 

11. Safety rods should be designed so that a 
rod cannot inadvertently withdraw a fuel element 
from the core. 

12. Failures of components inthe control-rod 
system should cause either no change in reac- 
tivity or should introduce a decrease of reac- 
tivity in the reactor. 

13. Independent channels are usually joined at 
a common point (compared) to provide a scram 
signal from any channel to all scram mecha- 
nisms. This common point where the channels 
are joined should be functionally as near the 
scram mechanism as possible. 

14. Open circuits, short circuits, andgrounds 
after the common point of the independent chan- 
nels should cause reactor shutdown unless the 
malfunction does not prevent subsequent reactor 
shutdown. 

15. Disconnection of any section of equipment 
common to all channels should cause reactor 
shutdown. 

16. Any switches or adjustments capable of 
rendering a channel inoperative shouldbe inter- 
locked to trip the channel when inthe nonoperate 
positions. 

17. Introduction of test signals should not open 
the normal signal path unless a monitoring sys- 
tem is used to assure continuity of the switched 
connection between transducer and amplifier in- 
put circuit. 

18. Malfunctions of test equipment should not 
prevent operation of the channel in a safe man- 
ner. 

19. The system should be designed in a man- 
her to assure location of the neutron detectors 





in a position where the flux has a relatively 
constant ratio to the average core fluxtoassure 
that this ratio cannot be changed by some means 
and to assure that the sensor is actually in the 
proper position. 

20. Means should be provided for determining 
that an indication of neutron flux is indeed caused 
by neutrons and not by other radiation or noise. 
This identification is generally difficult and may 
have to be accomplished by operational proce- 
dures. 


A problem of oversimplification exists in set- 
ting down criteria for evaluating the reliability 
of reactor control systems. Such criteria serve 
a useful purpose in pointing out some ofthe con- 
siderations of good design. They do not and can- 
not cover either the majority of criteria to be 
applied to a particular reactor or the most im- 
portant considerations of reactor safety. The 
greatest increase in reactor safety comes from 
improvements in reactor design which place less 
reliance for safety onthe reactor control system, 
such as favorable temperature, void, or power 
coefficients. 
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Evaluation of Containment System 


There have been a number of approaches to the 
design of reactor containment. The basis for 
selection of one type of container or another is 
generally a balance between minimum cost and 
control of the activity that would be dispersed 
in the event of the maximum credible accident 
(mca). The types of containment provisions 
usually considered may be divided roughly into 
three categories: (1) leaktight pressure-con- 
tainment shells encompassing the reactor cool- 
ant system in which the coolant system en- 
closure is the primary container and the shell 
is the secondary container; (2) confinement 
structures, such as an enclosed building, into 
which activity is released as it is generatedand 
exhausted through filters to a stack; and (3) 
self-contained fuel elements, which would re- 
lease only small amounts of activity during the 
mca, surrounded by the coolant system en- 
closure, which provides secondary containment. 

The first category is typified by the pres- 
surized-water and boiling-water reactors; the 
second, by the Oak Ridge Research Reactor, the 
Hanford and Oak Ridge Graphite Reactors, and 
the British Windscale Reactors; and the third, 
by the British gas-cooled reactors at Calder 
Hall, Berkley, Bradwell, Hinkley Point, and 
Hunterston. Discussions of the criteria used 
in the evaluation of these types of containment 
provisions have been given in a number of 
recent papers.’ ® 

Experience gained in the United States in 
designing secondary-containment vessels has 
been summarized in the June 1959 issue of 
Power Reactor Technology. '® The table in ref- 
erence 1 also includes silhouetts of the con- 
tainment vessels for a number of reactors. 


The EBR-II fast-reactor containment shell 
has been described by Monson and Sluyter.’ 
Explosion considerations are a particular fac- 
tor in this design because of the possible re- 
action between the sodium coolant and the air 
in the containment enclosure. In this case the 
containment shell is an 80-ft-diameter cylinder 
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with a hemispherical top and a semiellipsoidal 
bottom. The total height is 139 ft and 48 ft of 
the sheli is below grade. A 26°/,-in.-thick 
internal blast shield is provided between the 
reactor and the biological shield. The vessel 
is designed for an internal pressure of 24 psig, 
and its specifications are not greatly different 
from those for the containers for the boiling- 
water reactor types. However, because of the 


_ explosion potential from the sodium-air re- 


action, particular attention has been paid to the 
mode of energy release from the mca in this 
reactor concept. The following factors were of 
interest in arriving at the final design: 

1. The principal shock wave from the ex- 
plosion would be absorbed by the large volume 
of sodium coolant which surrounds the reactor. 
Only 10 per cent of the shock wave would reach 
the outer boundary of the sodium tank. 

2. The free surface of the sodium would 
greatly reduce the shock forces directed at the 
top of the vessel (reportedly by about two 
orders of magnitude) since most of the ex- 
plosion would propagate through the liquid 
sodium to the vessel bottom and sides. 

3. The duration of the shock wave imposed 
on the top of the vessel from argon pressure 
and liquid sodium would be less than 0.002 sec. 

4. Submersion of the major components in 
the bulk sodium tank would prevent them from 
becoming missiles. 


The analysis showed that the containment 
structure is capable of withstanding a detona- 
tion force equivalent to 300 lb of TNT. 

A condition of interest to the designers of 
the EBR-II containment structure was the tem- 
perature rise in the shell due to the heat 
generated from the sodium-air reaction. The 
shell is constructed of A201 carbon steel, 
which retains its strength at temperatures up 
to 650°F. Calculations were made todetermine 
the temperature rise in the shell due to the 
dissipation of heat from the reaction, and it 
was shown that, even on the basis of extremely 
pessimistic assumptions, the shell tempera- 
ture would not rise above 400°F. This result 


Wi. 
on 
tio 
the 


bre 
AS. 
fir 
all 

the 
re- 
the 
wou 


tion 
ves: 
stre 
ing 
be 1 


quir 
relic 
larg 


stre: 
ther 
area 
must 
lishe 


sel - 
apply 
cann 
blind 
quire 


raise 
for vy 
tainr 
to 1' 
heat 

perfo 
30°F 
would 
weld ; 
hydro 
notch 
a resi 
sults 

elimir 
ods fr 








“he 


ine 
the 
1 it 
ely 
ra- 
sult 





PLANT SAFETY FACTORS 23 


will be of particular interest to people working 
on reactor systems in which exothermic reac- 
tions might release large quantities oi heat to 
the containment enclosure. 

The discussion by Bergstrom and Chittenden! 
brought out the fact that Section VIII of the 
ASME Boiler and Pressure Vessel Code, Un- 
fired Pressure Vessels, has been the basis for 
all major reactor containment vessels built in 
the United States. The writers argued that 
re-evaluation of some of the requirements of 
the Code, as applied to containment vessels, 
would be appropriate for the following reasons: 

1. The Code provides for continual applica- 
tion of the design stress, whereas containment 
vessels are required to withstand the design 
stress only “once in a lifetime.’’ Thus lower- 
ing the factor of safety from 4 to 3.5 or 3 could 
be logical and justifiable. 


2. In larger reactors the thicknesses re- 
quired by the present Code require field stress 
relieving, which is probably impractical for a 
large vessel and thus limits the design. 

3. The Code does not take into account 
stresses at discontinuities in the surface, and 
therefore, to allow for stress concentrations, 
areas subjected to pure membrane stresses 
must have the same thickness as that estab- 
lished by the stress concentration points. 


4. Formulas for computing stresses in ves- 
sel openings have been developed mainly to 
apply to relatively small vessel openings and 
cannot be assumed to be conservative when 
blindly applied to the large vessel openings re- 
quired in containment vessels. 


Arnold of the Chicago Bridge & Iron Co.’ has 
raised a question about preheat requirements 
for welds in connection with the Dresden con- 
tainment vessel. For class P-1 materials 1'/ 
to 144 in. thick the Code requires a 200°F pre- 
heat of plates prior to welding. Tests were 
performed on plates which had been cooled to 
30°F after being assembled in a manner which 
would apply lateral and angular restraint to the 
weld area. The welds were performed with low- 
hydrogen electrodes, and no deterioration of the 
notch toughness of the weld area was found as 
a result of the failure to preheat. The test re- 
sults indicate that the 200°F preheat could be 
eliminated for vessels welded by similar meth- 
ods from similar materials. Elimination of the 


preheat requirement would result in substantial 
cost savings and reduced fabrication complica- 
tions. 

Evaluations of pressure-containment vessei 
designs have been presented by Smith and 
Randolph of the Bechtel Corporation‘ in con- 
nection with the selection of the Dresden con- 
tainment vessel design. The important differ- 
ences between containment vessels and ordinary 
pressure vessels are pointed out to be the 
following: 

1. Containment vessels are not normally 
under pressure. 

2. Personnel access through locks must be 
provided to avoid impairment of containment 
integrity. ; 

3. Ventilation air supply and exhaust must be 
provided. 

4. Safety valves defeat the purpose of the 
vessel. 

5. Missile shielding and leaktightness require 
special attention. 

6. Many penetrations of the vessel are neces- 
sary. 


Smith and Randolph discuss a number of 
alternatives considered for the Dresden design. 
The following criteria were used in the evalua- 
tion: 

1. Ease of design and construction of the 
containment membrane. 

2. Ease of design and irstallation of access 
locks and penetrations. 

3. Accessibility for inspecting and testing 
for strength and tightness. 

4. Predictability of the performance of ma- 
terials which make up the containment mem- 
brane. 

5. Economy in materials costs. 

6. Ease of design and construction of the 
transition between the containment membrane 
and the foundation. , 


The term “containment membrane’’ has been 
used to encompass all types of containment en- 
closures. For the Dresden design, in addition 
to the now almost conventional pressure vessel 
finally selected, concrete-lined enclosures with 
metallic membranes and anchored domes and 
tanks were all given consideration in the design 
evaluation. The containment vessel finally se- 
lected was a 190-ft sphere. Spherical vessels 
have proved to be the most economical con- 








tainment for boiling-water and pressurized- 
water reactors. A sphere is not the only 
method of containment, however, as evidenced 
by the others considered for Dresden. 

The Dresden design is described as utilizing 
partial containment; the turbine generator is 
outside the containment vessel. It is worth 
noting that in the boiling-water design, of which 
Dresden is typical, the reactor coolant (light 
water) flows directly to the turbine outside the 
containment vessel. Therefore, unless pro- 
visions for valving off the coolant inlet and 
outlet to the reactor are provided, the turbine 
forms part of the containment envelope. The 
PWR, the EGCR, and most other reactor types 
have an intermediate heat exchanger between 
the reactor coolant and the drive steam for the 
turbine, and the intermediate heat exchanger 
is located inside the containment vessel. How- 
ever, it should not be concluded from this de- 
sign difference that the Dresden containment is 
less satisfactory than that used in other designs 
since the mode of failure anticipated in a mca 
is all-important in determining containment 
design requirements. The kinetics of the mca 
determine the methods by which containment 
integrity must be maintained. 

Of significance also is the need for an in- 
ternal heat sink to absorb heat generated during 
the mca and by fission-product decay. In the 
case of Dresden, isolation of the turbine re- 
moves the heat sink represented by the turbine 
condenser, but a water-spray system is pro- 
vided to remove decay heat in this instance. 

The Dresden designers placed particular 
emphasis on the ability to meet the ASME Un- 
fired Pressure Vessel Code requirements, al- 
though it was not clear that they considered 
this essential to the containment membrane 
design. The particular containment structures 
considered were: 


1. A 180-ft sphere (later increased to 190 ft) 
with the turbine-generator external to the 
sphere. 

2. A 220-ft-diameter buried cylindrical vault 
with a sheet-metal liner and with steel hold- 
down columns. 

3. A 220-ft-diameter partially buried cylin- 
drical tank with steel hold-down columns. 

4. A tunneled vault. 

5. A capsuled vault to contain the reactor, 
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with the vault being a steel tank with hemi- 
spherical ends encased in concrete. 

6. A 220-ft-diameter steel hemispherical 
dome anchored in the rock excavation, with a 
metal membrane at the base. 

7. A 215-ft-diameter partially buried capsule 
encased in concrete to contain the reactor. 


Structures 1, 5, and 7 do not provide for en- 
closing the turbine; the other structures pro- 
vide full containment. 


The analyses of the various designs show 
each to present one or more problems, as 
described below: 

1. The concrete enclosed tanks and the dome 
type designs will not meet ASME Code require- 
ments. 

2. If the containment membrane must be 
anchored in the rock foundation the rock must 
be capable of withstanding shear loads, and, for 
the Dresden location, the performance of the 
rock: was unpredictable. It is apparent that a 
careful examination of the rock structure is 
required for such designs. 

3. Where the containment vessel is embedded 
below grade, the possibility of buoyant forces 
from ground water must be considered. Sur- 
rounding areas must be sealed against ground 
water or the foundation must be designed to 
withstand the buoyant forces. 

4. When a membrane must be supported 
directly by the foundation, pressure grouting is 
required, and there is concern about the ef- 
fectiveness of pressure-grouting procedures. 

5. Inspection and testing of the membrane 
when encased in concrete or rock impose a 
serious restriction on the design, because pres- 
sure testing cannot be performed without the 
encasement, and the encasement makes inspec- 
tion impossible. As pointed out by Bergstrom 
and Chittenden,'! a recent ASME Pressure Ves- 
sel Code ruling (Case No. 1228) permits pre- 
inspection and leaktesting of welded joints prior 
to placement of the concrete provided the 
complete vessel is ultimately given a pneumatic 
test under Code conditions. This ruling, which 
was passed after the Dresden plant was under 
construction, might have altered the design 
conclusions reached by the Dresden designers. 

6. The use of a membrane held down by 
columns complicates the equipment layout sub- 
stantially because of column interferences, and 
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there is inherent difficulty in anchoring the 
columns to withstand the high tensile loads. 
This problem is peculiar to designs in which 
large areas of membrane must be reinforced 
in this manner. Smaller installations, such as 
the aqueous homogeneous reactor at Oak Ridge, 
are contained by this method. 


7. Penetrations through buried or concrete 
encased containment systems are difficult to 
accommodate. 

8. Access for construction and fuel-handling 
complicates the containment design and tends 
to discourage compact arrangements which 
rigidly fix the construction sequence and allow 
little flexibility for design modifications. 

9. Temperature gradients between the con- 
tainment membrane and its foundations must 
be considered in the design. 

10. For a given pressure-containing con- 
figuration, when pressure-volume considera- 
tions determine the vessel size, the weight of 
material required in the pressure vessel is 
independent of the size of the vessel. Thus 
there is the alternative of designing a small 
vessel for high pressures or a large vessel for 
low pressures. Although not mentioned in the 
Smith and Randolph discussions,‘ loads imposed 
by the structure also have to be considered, and 
they sometimes govern the thickness of the 
containment vessel. Most large vessels have 
had material thicknesses in the range of */ in. 
to 1 in. in order to permit the vessel plates 
used in fabrication to have some dimensional 
stability. 


Chave and Balestracci> have described the 
containment vessel for the Yankee Atomic 
Electric power plant, which is a pressurized- 
water installation. The containment vessel is a 
125-ft sphere % in. thick supported by 16 pipe 
columns extending to eight concrete piers. 
Concrete shielding inside the vessel individually 
compartmentalizes the four coolant loops. Al- 
though the containment structure has adetached 
concrete liner which makes an effective missile 
Shield, the designers do not consider this 
necessary. As was the case for the Shipping- 
port reactor, ductile steel is used throughout 
the coolant system; this material is not capable 
of failure in a manner which would generate 
missiles that could penetrate the containment 
structure. The design considerations were es- 


sentially the same as those for Dresden, and 
the conclusions reached were parallel. 

Methods for establishing leaktightness re- 
quirements for pressure-containment struc- 
tures have never been well defined. Bergstrom 
and Chittenden' tabulated the tightness specifi- 
cations for a number of containment vessels. 
They range from 0.1 to 0.76 per cent of the 
contained volume per day under design pressure 
conditions. No pattern is apparent in the speci- 
fications. Bergstrom and Chittenden recom- 
mend 0.1 per cent of the contained volume per 
day as the design leak rate, but this appears to 
be based mainly on the fact that this is the best 
that anyone has ever attempted to do. The ac- 
cepted practice is to base the design leak rate 
on the consequences of an activity release re- 
sulting from the mca. 

None of the published material presently 
available gives an account of the design re- 
quirements for shutoff valves, ventilation, and 
emergency exits for containment structures. 
Filters and monitors on exhaust stacks, which 
are intimately involved in maintaining the con- 
tainment integrity, are also unevaluated. Simi- 
larly, the operating experience with existing 
containment structures is unreported for the 
reactors that are currently inoperation. These 
factors have much to do with the evaluation of 
reactor containment structures. 

The continuous exhaust of activity from the 
mca through stack filters has not been examined 
for many types of reactor. The Oak Ridge 
Research Reactor is designed to incorporate 
this containment principle, which has been 
described by Cole and Gill’ and by Binford and 
Burnett.’ The building is a steel frame struc- 
ture with insulated metal-panel siding and an 
insulated and built-up metal roof deck to pro- 
vide a water-tight seal. All joints on the in- 
side of the building are caulked and sealed. No 
exterior windows are provided and doors are 
sealed with rubber gaskets. Buildings of this 
type are not designed to contain pressure but to 
assure that gas outleakage other than through 
the stack will not occur during an activity re- 
lease. The following sequence of events would 
occur in the event of an activity release: _ 

1. The building ventilation system would shut 
down. 

2. An automatic damper would open an emer- 
gency duct. 
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3. A gas scrubber consisting of a packed 
tower sprayed by a 5 per cent caustic solution 
would absorb the released activity, principally 
iodine, and give a decontamination factor of 
99.95 per cent. 

4. Absolute filters would remove particulate 
activity down to 0.3) in size. 

5. The scrubbed and filtered vent gas would 
be exhausted by a 5000-cfm fan to the stack. 


The success of this inexpensive type of con- 
tainment is dependent on the effectiveness of 
the scrubber in obtaining a high decontamina- 
tion factor and the ability to maintain the ex- 
haust rate high enough to avoid building up a 
positive pressure in the containment building. 
The ORR scrubber is particularly effective for 
iodine, but for other sources of activity, such 
as the noble gases or strontium, adsoption 
media might be necessary, and the permissible 
throughput for adsorptive materials, such as 
activated carbon, can, in some cases, require 
a prohibitively high pressure drop across the 
adsorber. In such cases it might not be pos- 
sible to meet the criterion of no positive pres- 
sure in the containment building during an 
emergency. 

The principle under which the self-contained 
fuel element can meet the reactor safety con- 
tainment criterion has been studied briefly at 
ORNL.® The conditions under which the ORNL 
GCR-2 was considered to be adequately con- 
tained without a secondary containment struc- 
ture are quoted below: 


“The hazards philosophy adopted for the 
GCR-2 was that two independent and improbable 
events, i.e., simultaneous leaks in a large 
number of fuel element capsules and the cool- 
ant gas circuit, either of which is immediately 
apparent to the operator, are required to pro- 
duce a hazardous situation.”’ 

It is fundamental to this containment concept 
that there be a good system of fuel-element leak 
detection since the reactor operator must be 
able to shut down the system before leaks be- 
come significant. It is also essential that the 
containment system be adequate to allow for the 
maximum number of fuel-element failures re- 
sulting from the mca. An analytical approach 
to the evaluation of this condition has been 
described’ as part of a report setting forth a 
hazards evaluation of a 30-Mw, prototype, 
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partially enriched-uranium-fueled nuclear 
power plant. In the evaluation the mechanism 
of failure from the mca was traced, and it was 
shown that the amount of activity released when 
a rupture of the primary coolant system oc- 
curred was less than that which would subject 
the bystander to the maximum personal dose 
limit accepted by the AEC. ‘This method of 
analysis is adequate only when the mechanism 
of activity release is clearly understood, and 
the uncertainties of such an analysis must be 
given careful scrutiny. 

The foregoing discussion illustrates the va- 
riety of considerations to be factored into con- 
tainment evaluation. It is apparent that no 
standard method of containment can be estab- 
lished for all types of reactors. The following 
seem to be the major premises on which each 
system is based: 

1. Pressure containment is necessary when 
large amounts of activity are released con- 
currently with large volumes of coolant fluid 
under pressure. 

2. Confinement structures are applicable 
when the activity released can be effectively 
scrubbed from the vent gas and the quantity of 
vent gas is small enough to be readily exhausted 
by conventional exhaust fans. 

3. Fuel-element self-containment is feasible 
only when it can be shown that failure of the 
primary coolant containment system will not 
lead to failure of encapsulated fuel elements 
that would release substantial quantities of 
activity to the surrounding atmosphere. In any 
case, a thorough understanding of the mechanism 
and kinetics of the maximum credible accident 
is essential in evaluating the containment de- 
sign. (M. Bender) 


Structural Integrity of 
Containment Vessels 


In order to minimize or eliminate the hazards 
associated with a nuclear reactor excursion, 
the reactor vessel or the reactor vessel and its 
containment shell must be designed to withstand 
both the internal pressure associated with the 
energy release and the missile impact. There- 
fore, the basic information associated with ves- 
sel behavior in each case must be determined 
before optimum containment design can be 
achieved. 
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The successful containment of a nuclear re- 
actor excursion in which a large internal pres- 
sure is developed depends upon the ability of 
the pressure vessel to absorb energy through 
the mechanism of extensive plastic deformation. 
The strain-energy absorption characteristics 
of a given vessel bear little or no relationship 
to the ability of the vessel to meet design 
operating conditions. This is true because the 
allowable design stresses are necessarily 
limited to values which fall below the yield 
point of the material. Because of these facts, 
Wise, U. S. Naval Ordnance Laboratory, is 
investigating the energy absorption potential of 
pressure vessels.'! 

The premise underlying the investigation is 
that, for a given energy release and release 
rate, an optimum containment design exists. 
The design parameters are material, configura- 
tion, constraint, and size. The strain-energy 
equation of dynamic equilibrium for an inter- 
nally loaded, hollow right-circular cylinder 
closed at the ends with rigid disks which pro- 
vide rigid radial end restraints was obtained by 
considering the total energy in the system. The 
energy equations were simplified for the case 
of a homogeneous and isotropic cylinder sub- 
jected to a rotationally symmetric loading, and 
they were written in terms of experimentally 
obtainable transient loading and structural re- 
sponse parameters. 

An experimental program was established in 
order to obtain the quantities required for 
calculating the strain absorption of a given 
shell. The quantities determined experimentally 
were the pressure bearing upon every internal 
differential area of the solid system and the 
radial and longitudinal coordinates of each such 
area. Both the pressure and the coordinates 
for a given area are functions of time. 

Experiments were conducted using 5-in.-I.D., 
%-in.-wall, 12-in.-long cylindrical specimens. 
The first series of tests was made onseamless, 
MT-1015-20 steel, mechanical tubing. Follow- 
ing this series of tests, specimens made from 
a Single centrifugal casting of type 304 stainless 
steel were tested. In both series of tests the 
cylinders were dilated hydrostatically and dy- 
namically. The dynamic dilations were achieved 
through the use of SPDN 6627-6”/47 solid pro- 
pellant. The propellant was contained in a 
right-cylindrical vented case mounted inside the 


vessel with its vertical centerline aligned with 
that of the vessel. The design of the case al- 
lowed for dispersion of the propellant gases 
through vents in the case wall in a rotationally 
symmetric pattern. The pressure-transmitting 
vehicle was CCl,, which filled the annulus be- 
tween the test cylinder and the propellant case. 

In the first series of tests, the MT-1015-20 
steel specimen ruptured at a hydrostatic pres- 
sure of ~9200 psi, and the maximum external 
radial dilation at midheight was 0.053 in., im- 
mediately prior to rupture. Thus the maximum 
elongation was ~2 per cent. Under dynamic 
loadings, it was found that 31 grains (114.5 g) 
of propellant would produce rupture, whereas 
29 grains would not. It was also evident that 
the plastic strain prior to rupture was small. 

One of the type 304 stainless steel speci- 
mens was hydrostatically dilated. Atapressure 
of 6700 psi, leakage occurred at the joint be- 
tween the cylinder and an end closure. Rupture 
of the vessel did not occur, and the maximum 
external radial dilation corresponding to the 
peak pressure was 1.182 in. Following this, 
four additional specimens were dynamically 
dilated with charges of 28, 47, 72, and 100 
grains, respectively, of solid propellant. The 
cylinder, which was dilated with 100 grains, 
ruptured at a pressure of ~7300 psi in39 msec. 
The following tabulation gives the radial dila- 
tion as a function of the propellant charges. 


Charge (grains of Maximum external radial 


solid propellant) strain, in. 
28 0.220 
47 0.468 
72 0,990 
100 1,315 (prior to rupture) 


The amount of strain energy absorbed as a 
function of distance along the axis was calcu- 
lated for both the hydrostatically dilated cylinder 
and the one dilated with 100 grains of propellant. 
In the former case the strain energy absorbed 
at a particular axial location was ~ 72,500 ft/lb, 
whereas in the latter, it was ~ 84,000 ft/lb for 
the same strain. The increase instrain-energy 
absorption can be attributed to the rate of 
strain effect. 

A comparison of the data from the two series 
of tests reveals that the strain-energy absorp- 
tion characteristic of the type 304 stainless- 
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steel vessels was much greater than that of the 
particular MT-1015-20 specimens. However, it 
must be pointed out that the magnitude of the 
difference in energy absorption between the 
two steels is not only dependent on the con- 
stituents, it is greatly affected by the prior 
histories of the specimens. In other words, 
such factors as cold work and irradiation dam- 
age could have considerable influence upon the 
amount of strain energy absorbed by a given 
vessel. 

In the investigation described above, pres- 
sure vessel models were tested for their 
ability to withstand only a rotationally sym- 
metric internal pressure loading. However, 
the integrity of a reactor vessel can also be 
destroyed by missiles or a combination of 
missile and pressure loadings. Tests were 
conducted by Zabel of the Stanford Research 
Institute to investigate the penetration of plate 
targets by rod-like projectiles.'*'® The first 
report includes an expression relating the plate 
thickness and the kinetic energy per unit di- 
ameter required for penetration of a mild steel 
plate. Since its application is limited, it is not 
included here. Experimental results demon- 
strating the effects of various parameters upon 
the energy of penetration are also described. 
The parameters were target material, distance 
of impact from target restraint, angle of inci- 
dence, shape of projectile, and projectile ma- 
terial. 

Because the early experiments showed that 
steel plates could be penetrated more easily if 
they were rigidly held near the point of impact, 
further tests were conducted using hanging 
plates with free edges. Cylindrical steel rods 
were used as piv iertiles, and the projectile 
kinetic energy pe. «ut diameter required to 
penetrate a given plate was used as a basis for 
comparison. The distance from the edge to the 
central point of impact was varied by changing 
the plate size. The plates were 0.120-in.-thick 
mild steel squares, and the sizes ranged from 
6 to 24 in. on a side. 

The penetration experiments showed that a 
critical plate size, or critical distance from the 
edge to the central point of impact, exists. The 
kinetic energy per unit diameter required for 
penetration when the distance is above critical 
is the same as that for the critical distance 
(see Fig. 4), and the energy is also independent 
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of the type of support. When the distance is 
smaller than critical, the kinetic energy re- 
quired for penetration with free boundaries in- 
creases with decreasing distance. Conversely, 
the energy decreases for rigid boundaries. 

The important fact demonstrated by the data 
is the existence of a critical distance. The data 
given here apply only to the projectile-target 
system used in the experiments. Hence, ad- 
ditional tests should be conducted to determine 
the correlation of the critical distance with such 
parameters as plate thickness, target material, 
etc. 
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Figure 4—Threshold penetration of mild steel 
plates = 


There is evidence that the structure of the 
metal is important to the penetration resistance 
of a plate. For example, cold work or exposure 
to high temperatures for a long period of time 
could appreciably alter the resistance. 

From the results obtained, the kinetic energy 
required for a given projectile to penetrate a 
given area of a pressure vessel depends both 
on location and the structure ofthe metal. Thus, 
a section of material with large grains which is 
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near a reinforcement or support would be 
particularly vulnerable to penetration by mis- 
siles. As suggested, such an area could be 
protected by mounting weakly supported baffles 
in the region. (B. L. Greenstreet) 


Containment Vessel 
Leak Detection 


The principal function of a containment shell 
is to retain the fission products from a reactor 
accident. In practice a maximum credible ac- 
cident is defined, and the containment shell is 
designed so that the activity from this accident 
cannot leak from the containment vessel at such 
a rate as to subject off-site persons to exces- 
sive exposures. The leakage rate thus estab- 
lished is the most important criterion for the 
containment vessel, and the ultimate purpose 
of all tests and inspections of the vessel is to 
assure that the specified leakage rate is never 
exceeded. The establishment of the integrity 
of containment buildings of the pressure-vessel 
type in the United States has, in general, been 
based on inspections and tests of the types 
described below. 


1. Inspectionsof Weld Quality. All shell 
joints of vessels built according to the ASME 
Boiler and Pressure Vessel Code have been 
fully radiographed, and shell joints of vessels 
built according to the API Tentative Standard 
620 have been examined by spot radiography. 
Welds not susceptible to radiographic examina- 
tion; for example, nozzles, such as air-lock 
penetrations, have been subjected to magnetic 
particle examinations. The first pass of a 
welded joint has also frequently been checked 
by a magnetic-particle examination. 

2. Spot Leak-detection Tests of Welded Seams. 
Soap-bubble testing of seams has been per- 
formed both prior to and after overload pneu- 
matic testing of vessels. In addition to the 
Soap-bubble test, a halogen tracer-gas test 
involving hand probing of all welded seams was 
specified for the Yankee containment vessel.'4 


3. Leakage-rate Tests Based upon Pressure- 
drop Observations Both before and after Equip- 
ment Is Installed. The successful completion 
of the above inspections and tests is no as- 
surance of an adequately leaktight vessel since 
leaks can exist in areas not inspected or tested 


and it is even possible to have leaks in areas 
that have passed x-ray inspection. Conse- 
quently, it is necessary to perform an integral 
leakage rate test on the vessel, even though the 
commonly employed pressure-drop test is 
rather insensitive. (The soap-bubble test, for 
example, will indicate a leak—if the soap is 
applied to the leak——that would not be detected 
by a pressure-drop test.) '5 Fortunately, per- 
missible leakage rate specified for containment 
vessels have been of sufficient magnitude (from 
approximately 0.1 to 1.0 per cent contained 
atmospheres per day') to permit testing by 
pressure-drop observation; otherwise leakage- 
rate testing would be very costly and time 
consuming. - 


Considerable difficulty is encountered in a 
leakage-rate testing by observation of the pres- 
sure drop because erratic data can result from 
changes in the temperature, relative humidity, 
and barometric pressure of the atmosphere in 
the vessel. These deleterious effects were 
combated in the testing of the EBWR contain- 
ment vessel'® by recirculation of the ves- 
sel’s atmosphere to prevent stratification and 
by monitoring vessel and atmosphere tempera- 
tures, the relative humidity, and the barometric 
pressure in aneffort to detect obviously spurious 
readings. Even with this careful approach, 
eight days of testing were necessary to estab- 
lish accurately the trend of the leakage-rate 
curve. 

Temperature compensation was provided in 
the leakage-rate testing of the General Electric 
Vallecitos Boiling Water Reactor Plant, the 
Wright-Patterson Air Field Plant, and the, 
Dresden Nuclear Power Station containment 
vessels.!”8 Small preleak-tested chambers 
were interspersed throughout the containment 
vessels and interconnected with tubing to one 
leg of a manometer which had its other leg 
connected to the containment vessel atmosphere. 
Although there were slight temperature lags 
between chambers and containment vessels,'' 
temperature effects on leakage-rate detection 
were notably reduced. 


Since air locks and other penetrations of the 
containment shell are critical components of 
the containment shell and perhaps more sus- 
ceptible to leakage than the containment shell 
wall, particular care has been given to the leak 
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testing of these items by soap-bubble test- 
ing'®17,19 to ensure that all seals are tight. 
Continued assurance of integrity is a prob- 
lem that has been neglected to a large extent. 
However, the Yankee containment vessel will 
be continuously monitored by maintaining a 
slight, positive pressure by means of make-up 
from a manifold of compressed-air cylinders 
and by monitoring the weight loss over a period 
of time. At Dresden periodic soap-bubble leak- 
detection tests at 2 psig are planned for critical 
seals of the containment vessel, such as air- 
locks and bulkhead penetrations. Provisions 
such as have been made at these installations 
are indicative of the present trend toward pro- 
viding adequate containment not only at the 
completion of construction but also through- 
out the life of the plant. (G. C. Robinson) 
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ACTIVITY RELEASE AND CONSEQUENCES 








Activity Build-up 


The highly radioactive coolant of a liquid-fueled 
reactor system has always posed a Serious de- 
sign problem. The problem is reduced in solid 
fuel reactors by placing two barriers between 
the fission products and the coolant: (1) the 
solid fuel itself and (2) the canning or cladding 
material. Coolant activity in solid fuel reactors 
is largely the result of corrosion product ac- 
tivation. While low compared to activity levels 
encountered in fluid fuel reactors, these levels 
are still high enough to require elaborate de- 
contamination measures. 

Experimental data are being obtained on the 
build-up of long-lived activity (half life greater 
than about 50 days) in stainless-steel-clad 
water-cooled reactor systems at the Army 
Package Power Reactors (SM-1, formerly des- 
ignated APPR-1), Fort Belvoir, Va.'~* The 
information obtained from the SM-1 has been 
summarized in a review article.’ Some of the 
significant findings of this work are presented 
here: 


1. During the first year of SM-1 operation, 
coolant activity has been dominated by Co™ ac- 
tivity (71-day half life) resulting from the reac- 
tion Ni*®(n,p)Co™®. 

2. The Co* activity (5.2-year half life) re- 
sulting from neutron captures in the stainless- 
steel impurity Co™ is significant and will ulti- 
mately reach and pass the Co® activity 
(assuming that the present trend continues). 

3. Coolant temperature has a marked effect 
on surface deposition of coolant activity. More 
activity is deposited on samples in high- 
temperature water than on samples in low- 
temperature water. 


The importance of the Ni®(n,p)Co™® reaction 
was unexpected because of a lack of knowledge of 
the cross section of this high-energy reaction 
(the Coulomb barrier for the proton is about 
5 Mev). The appearance of the Co” activity was 
also unexpected because the Co” impurity was 
of negligible concern to previous users of stain- 


less steel and consequently was not included in 
the producer’s analysis. This revelation has in- 
fluenced the Co™® specification for Core II ofthe 
SM-1 reactor,’ as well as the specifications for 
the reactor core materials to be used in the 
N. S. Savannah.*' 

Other major contributors to the build-up of 
long-lived activity in the SM-1 primary system 
are Fe*®, Mn™, and Cr®!, all of which are com- 
ponents of type 304 stainless steel. A research 
and development program has been initiated to 
determine ways of decontaminating the SM-1 
primary system. Preliminary results® indicate 
that a caustic permanganate treatment followed 
by an acid rinse may achieve decontamination 
factors of about 20 without serious attack of the 
stainless steel. 

The operation of the Shippingport Pres- 
surized Water Reactor (PWR) should provide 
useful data on the build-up of activity in the 
water coolant of a reactor with zirconium-clad 
fuel. An extensive program’ is being initiatedto 
measure the radiation field around the PWR as 
a function of time. An important part of this 
program is the so-called “hair-pin loop” facility 
which contains a representative sample of the 
circulating water coolant and which can readily 
be isolated from the main system for detailed 
examination. The hair-pin loop is to be moni- 
tored periodically with a scintillation counter 
which can be coupled with a gamma-ray spec- 
trometer, if necessary. About every six months 
the hair-pin loop is to be disassembled and 
radiochemically analyzed for fission products, 
as well as for hafnium, iron, and cobalt activi- 
ties. Since the PWR core contains very little 
stainless steel, the build-up of cobalt activity in 
the water coolant should provide information on 
the importance (with respect to coolant activity 
build-up) of cobalt-bearing materials outside the 
core but within the primary system (pressure 
vessel, piping, etc.). Data fromthe hair-pin loop 
facility are to be correlated with periodic ac- 
tivity surveys of expected primary system hot 
spots (pumps, valves, boiler inlet and outlet, 
etc.), as well as with information from the 
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failed fuel element detection system and withthe 
monitoring results from the crud probe. 
Operation of the SM-1 and PWR reactors 
should provide very useful data on primary sys- 
tem activity build-up for the reactor designer. 
However, before the build-up of activity as a 
function of space and time can be predicted, 
much more basic research will be needed to de- 
termine how activation products are formedand 
where they are deposited. (E. E. Gross) 


Fission-product Release 


An investigation of a simulated nuclear acci- 
dent involving melting of a full-size zirconium- 
alloy PWR fuel subassembly has been conducted 
by the Mine Safety Appliance Research Corp. 
(MSA) in cooperation with the Westinghouse 
Atomic Power Division.'® The experiment was 
carried out to determine the magnitude of 
fission-product release and the resulting dis- 
tribution of the fission products by plating, at- 
mospheric release, and subsequent fallout. The 
fuel assembly used consisted of nine Zircaloy- 
clad plates with the central plate removable. 
The assembly was irradiated at a very low inte- 
grated flux of 2x 10'‘ neutrons/cm’ in the 
Battelle reactor. The 2'4- by 1°4- by 15-in. as- 
sembly was mounted with the bottom half inserted 
in the working coil of an induction heater. Melting 
was carried out in a steam atmosphere, withthe 
melt being allowed to drop into water. 


The experimental apparatus consisted of a 
thick-walled stainless-steel meltdown chamber 
of about 50-gal capacity, a “fall-out” chamber of 
about 100-gal capacity, and a steam generator 
and condenser. A charcoal trap was used for 
collection of active gases. To obtain analytical 
material balances, a small punched sample, ir- 
radiated simultaneously with the fuel bearing 
plate, was put into solution as a standard. Low 
counting rates might have affected the final re- 
sults to some extent. 

The results of previous work at ORNL" ona 
miniature scale were available as a guide inthis 
investigation. 

The following conclusions summarize the 
principal data presented in the paper. 


1. Of the metal actually melted, about 20 per 
cent reacted with the water and hydrogen was 
liberated, but there was no self-sustaining reac- 
tion and no apparent effect on the fission- 
product release. 
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2. The molten metal completely filled the 
voids in the assembly and was observed to 
stream rather than drip from the channels. 

3. Release of xenon ranged from 42 to 58 per 
cent and was relatively independent of meltdown 
characteristics. (This observation is inconsist- 
ent with the ORNL results, which indicated 100 
per cent release.) The quantity of xenon released 
has been interpreted as a measure of the per- 
centage of core metal actually melted.” 

4. Iodine was released in amounts of 1.3 to 7.6 
per cent and from 17.9 to 25.8 per cent under 
conditions of low and high heat inputs, respec- 
tively. 

5. Strontium and barium released from the 
fuel ranged from 0.7 to 1.6 per cent. About 10 
percent of this was found beyond the meltdown 
chamber. 

6. About 0.6 per cent of the cerium and 
yttrium was released, with little more than one- 
tenth being outside the initial chamber. 

7. Cesium release ranged from 0.4 to 0.5 per 
cent. This apparent suppression of cesium re- 
lease is attributed to its behavior at trace con- 
centration. 


A recent ORNL report describes an extensive 
series of experiments in melting irradiated re- 
actor fuels under conditions intended to simulate 
the loss-of-coolant type of accident.'® Particu- 
lar emphasis has been placed on the APPR 
stainless-steel-clad UO, fuel and on zirconium- 
clad uranium-zirconium alloy fuel plates of the 
STR type. Other fuels examined, some only 
superficially, were MTR type aluminum alloy 
fuels, Geneva type aluminum-U,O, dispersion 
fuels, solid UO, fuels, and the GE-HTRE fuel. 


The status of work of Brewer“ on the py- 
rometallurgical spent-fuel-recycle program and 
on high-temperature thermodynamics is cited 
as a guide to be used in anticipating logical be- 
havior of the fission elements. Since even the 
simplest concept of a loss-of-coolant accident 
cannot avoid including a number of variables, 
some attention has been given to the effects of 
time of heating, total time molten, presence or 
absence of an oxidizing atmosphere, presence of 
exposed or concealed edge of fuel, and heating to 
temperatures below the melting point. The spe- 
cial effect of burn-up is considered separately. 

In a typical experiment, a small specimen or 
miniature fuel plate was melted. This is usually 
done by induction heating. Volatile components 
were selectively trapped and radiochemically 
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identified. Material balances were developed to 
indicate percentages of each fission product 
either contained or dispersed from the source. 

There has been relatively little experimental 
work of a similar nature reported,'® and there- 
fore it was of special interest to compare these 
results with those of the somewhat larger scale 
work conducted by MSA.'° Table V-1 is a com- 
parison of the ORNL results of the fission- 
product release from Zircaloy-clad STR fuel 
plates with the MSA results for Zircaloy-clad 
plates. 


Table V-1 FISSION-PRODUCT VOLATILIZATION BY 
MELTING ENCAPSULATED ZIRCALOY PUNCHED 
DISKS AFTER 15 PER CENT BURN-UP 





ORNL results ® 





For For MSA* results 
melting melting for melting 
in air in steam in steam 
Heating time, sec 20 30 
Activity released 
(% of total present, 
averaged results of 
several tests): 
Rare gases 100 100 42—58 
Gross gamma 3.4 6.3 
Iodine 26.2 46.6 7.9-—25.8 
Cesium 10.6 18.7 0.5 
Strontium 0.85 1.8 0.7-1.3 
Barium 0.2 0.4 0.5-—1.6 
Cerium 0.004 0.03 0.6 





*Mine Safety Appliance Research Corp. 


The consistently lower release values ob- 
served by MSA for all fission products other 
than cesium are believed to be adequately ex- 
plained as an apparent measure of the percentage 
of the fuel plate actually melted. Their very low 
cesium value is believed to be an outstanding 
example of the burn-up effect since the MSA re- 
sults were obtained for trace concentrations of 
fission products. 

The following conclusions seem tobe justified 
by the accumulated data. 

1. The composition of the fission products re- 
leased to the atmosphere from a quiet meltdown 
of reactor fuel is limited mainly to the “volatile 
constituents’’ whose boiling points are less than 
the melting temperature (or the maximum tem- 
perature obtained during ignition) of the fuel. 

2. The release values are affected by length 
of time of heating, the concentration of fission 
products (burn-up), degree of oxidation, andtype 
of fuel, etc. 


3. All results indicate an exponential correla- 
tion with the fuel melting temperature when other 
conditions are held constant. (G. W. Parker) 


Environmental Monitoring 


During the period immediately following a 
radiation incident involving environmental con- 
tamination, much of the monitoring activity is 
directed toward the accumulation of data with 
which the effects of the contamination are meas- 
ured. In many cases the ultimate value of the 
data is unknown at the time of collection, but, in 
view of a possible uncertainty in what and how 
much monitoring data are needed, it is generally 
advisable to obtain as much as possible under 
the circumstances prevailing at the time. In addi- 
tion, the disappearance of the contamination 
through physical and biological processes may 
allow little time in which to plan a detailed 
monitoring program subsequent to an accident. 
Preplanning can be of considerable value, but 
this could easily be obviated by the nature of the 
accident. 


In the process of data interpretation, the prob- 
lem of correlating the various pieces of informa- 
tion can be troublesome. An interesting account 
of some of the work carried out by the Atomic 
Energy Research Establishment (AERE) follow- 
ing the Windscale accident has been reported. ' 
The report describes the measurements of the 
- activity in samples of soil, grass, and milk, 
as well as dose rates found in the contaminated 
areas. The correlation between these measure- 
ments is also discussed in considerable detail. 


Scintillation counters were used to determine 
the dose rates in the areas contaminated by the 


_accident. The measured dose rates were then 


converted into equivalent surface contamination 
in units of microcuries per square meter by ad- 
justing the theoretical dose rate above infinite 
plane sources uniformly contaminated with vari- 
ous gamma-emitting isotopes with the known 
energy response characteristics of the instru- 
ment. This theoretical calibration was checked 
by measuring the dose rate above an array of 
discrete sources of the same three types (Cs'*", 
1'3! Te! + 1'%) as those used in calculating the 
dose rates. After making a correction for the 
finite size of the array, the agreement for the 
two methods was good. It was foundthat the type 
of surface upon which the array was located had 
a measurable effect on the dose rates, but this 








would be difficult to allow for inthe calculations 
and probably is not justified in view of the good 
agreement. 

Dose rates are reported for a seven-week 
period beginning the day after the accident fora 
point near Seascale, about 1.7 miles from the 
site of the accident. The background dose rate 
was obtained eight months following the accident 
and was used to correct the raw monitoring data. 
The resulting decay curve fits the decay of 8d 
I'*! quite well during the last three weeks of the 
reported data. Another component of the gross 
decay curve was resolved by subtracting the I'*! 
extrapolated contribution during the first four 
weeks; this was assumed to be 3.2d Te’ + I'*, 
Table V-2 gives the ground contamination and 
the dose rates of 1 m due to the two assumed 
contributors, as well as the values for Cs'*" ob- 
tained from laboratory measurements on the 
soil. 


Table V-2 GROUND CONTAMINATION AND 1-M DOSE 
RATES AT SEASCALE ON OCT, 11, 1957 





1-m dose rate, Ground contamination, 





Isotopes mr/hr uc/m?* 
'3! 0.12 17 
Te'S? + 1132 0.37 10 
Cs'37 0.003 0.3 





The activity ratio, I'*'/Te'”, in the undistrib- 
uted fission products on Oct. 11, 1957, was cal- 
culated to be 1:0.75. This agrees remarkably 
well with the measured value of 1: 0.6, as shown 
in Table V-2. By assuming this ratio to be con- 
stant throughout the fall-out zone, the ground 
contamination at other locations was determined. 

Samples of grass and soil were obtainedfrom 
various areas and taken to the laboratory for 
more precise measurements by gamma spec- 
troscopy. Excellent agreement was obtained with 
the two independent methods. The laboratory 
measurements also provided the only estimate 
of the Cs'*" levels. 

Aerial surveys were made on the ninth and 
twelfth days following the accident with gamma 
scintillation counters flown at an altitude of 
500 ft. Uncertainties in the background of the 
contaminated area limited this interesting tech- 
nique to those areas where the counting rate was 
at least five times the background rate. The 
background rate was estimated from flights over 
water and over uncontaminated ground of known 
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geology. Unfortunately, in only a few locations 
did the position of the aircraft correspond with 
the location of one of the ground measurements. 
Even so, in the five cases reported, the ratio of 
the counting rate to the dose measured at 1 m 
was reasonably constant. With the correlations 
observed, a counting rate at 500 ft equalto twice 
the background would correspond to a 1-m dose 
rate from these same contaminants of about 
30 ur/hr. 

The most interesting aspect of this paper deals 
with the relationship of the I'*! activity in milk 
from the Seascale area and the ground contami- 
nation previously mentioned. The observed ratio 
of the I'*! ground contamination to the milk con- 
tamination increased by a factor of about 5 during 
the period of the measurements. This was ex- 
plained as resulting from a transference of the 
activity from the grass to the ground by both 
physical and biological processes (leaching by 
rain and translocation to the grass roots). Of 
course, field measurements of the ground con- 
tamination cannot distinguish between 1'*! in the 
soil and that in or onthe grass. The ratio varied 
from 17yc/m’ per uc/liter on October 12 to about 
95 uc/m’ per yuc/liter on November 28. Withthe 
survey instruments used it was estimated that the 
minimum level of ground contamination which 
could be reliably measured was 0.24 1c/m’. This 
corresponds to a milk activity of 0.014 yc/liter at 
short times following such an accident. 

Additional results of the laboratory measure- 
ments, as well as the details of the analytical 
techniques, are reported ina companion paper." 
Small thallium-activated sodium iodide crystals 
were used with single-channel analyzers for 
relatively pure samples, while multichannel 
analyzers were used when several gamma emit- 
ters were present in the sample. Quoting from 
reference 17: 

“In the first few days after the incident, he 
activity in the samples was predominant to such 
an extent as to mask other activities. By retain- 
ing samples until the I'* had decayed, the pres- 
ence of other nuclides was demonstrated. The 
fission products Cs'*", Ru!) Ru! and Zr", 
with their daughter products, were found in the 
herbage and soil, and Cs‘*" was found inthe milk. 

“Although the dissemination of I'*! from the re- 
actor reached a peak in the early hours of 
October 11 and ceased by about noon on that day, 
the activity did not appear in the milk of local 
cows until the afternoon of October 11. The 
maximum activity in the milk was reached on 
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the afternoon of October 12 or the morning of 
October 13.”’ 

The I'*! activity in samples (from remote 
areas) of milk ranged from less than 0.3 muc/ 
liter to well over 1000 muc/liter for a few 
samples from points close to Windscale. An 
average value for the apparent half life of the 
I'*! in the milk was found to be five days. Results 
through October 28 were corrected back to 
October 11, using the five-day halflife, and were 
plotted on maps of the area. The picture of fall- 
out distribution agreed with what might be ex- 
pected from the meteorological conditions and 
with observations on air filters from different 
parts of England. 

Samples were analyzed for Cs” after suffi- 
cient time had elapsed for the I'*! todecay to an 
insignificant level. The maximum Cs'*" activity 
in milk was found to be 15 muc/liter in a sample 
taken about 8 miles from the plant. 

Many herbage samples were collected from 
the area near Windscale and from various areas 
up to 200 miles from the stack. Samples analyzed 
for I'3! ranged in activity from 0.2 to 82 uc/m? 
and again exhibited an apparent half life of 5 
days. Results of the analyses, when plotted ona 
map, gave contours which agreed well with those 
obtained from the map of the I'*! activity in 
milk. After decay of the I'*! activity to a negli- 
gible level, the following gamma-emitting iso- 
topes were identified: Ce'!, Ce'4, Ru’? Ru’. 
Rh’S, Cs'*" and Zr®°-Nb*. Quoting further from 
reference 17: 

“Soil samples were taken at anumber of points 
in the fall-out area from which herbage samples 
were taken. Analyses were made for Sr®, as 
well as for the gamma-emitting isotopes. The 
low proportion of Sr* in the herbage relative to 
that in the soil indicated that most of the Sr” in 
the soil was not associated with the accident. 

“When the results for I'*! inherbage were com- 
pared with the level of activity in milk from the 
same area, a correlation was obtained between 
the herbage activity and the milk activity. The 
median of 30 ratios showed that 11 yc/m’ of 
herbage produced 1 uc/liter of milk. ... An 
estimate of the total deposition of I'*! was made 
from the herbage contour maps, giving a figure 
of about 20,000 curies, of which about 11,000 
curies were deposited in Great Britain. ... 

“The versatility of the gamma-scintillation 
Spectrometer was demonstrated by the measure- 
ment of the gamma activity of numerous biologi- 
cal samples in many different forms and of 


137 


widely varying specific activity. One chief ad- 
vantage which this method holds over conven- 
tional chemical separations is the small amount 
of preparation required for samples.’’ 
(H. H. Abee) 
Environmental monitoring of the area sur- 
rounding a nuclear facility during its normal 
and routine operation has also been considered. 
In general, such monitoring programs differ 
from those previously described only inthe level 


of activity found. The routine monitoring pro- 
gram is usually concerned with many samples of 
low activity, and, almost without exception, 
laboratory techniques are required to obtain 
valid analyses. 

While the pro’s and con’s of routine environ- 
mental monitoring programs are debated at in- 
tervals, almost everyone agrees to at least a 
minimal effort. The exceptions are those who 
feel that in the case of power reactors environ- 
mental surveys are not necessary except in cases 
of accidental releases,'® the argument being that 
routine escape of activity is negligibly small and, 
in any event, canbe more easily monitored at the 
source. The preponderance of opinion, however, 
seems opposed to this view. The recent reduc- 
tions in the maximum permissible exposures 
will have some effect on this very point. 

One proponent for the complete monitoring 
program has recently published his views.'* His 
paper provides a descriptive summary of the 
various pre- and post-startup surveys he recom- 
mends for a power reactor facility. The preoper- 
ational surveys would continue for a period of 
12 months or more to provide seasonal coverage. 
The experience and information acquired from 
this program would then be used inthe design of 
the operational survey program. While various 
environmental factors, as well as the specific 
reactor type, may modify the outlined survey, 
the recommended program consists of routine 
field surveys for activity in samples of air, 
water, and soil. For the most part the recom- 
mendations will be familiar to those with experi- 
ence in this field. 

The air-monitoring program is limited to con- 
sideration of airborne radioactive particulates, 
except for a casual reference to A‘! measure- 
ments, which are said to be unnecessary in the 
case of water or sodium-cooled reactors. (This 
latter statement would appear to be questionable 
in view of the experience of the Georgia Nuclear 
Laboratories with the Radiation Effects Reactor 
(RER) located at Marietta.) No mention is made 
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of the value of autoradiographs obtained from Reactor, APAE-29, Apr. 15, 1958. (Unclassified 
air-filter samples and gummed fall-out collec- AEC report.) =" 
tors. 4. W. H. Zinn et al., Activity Build-up in PWR’s with 
The discussion of water-monitoring require- Stainless Steel Elements, Nuclear Power, 4: 109- Nu 
ments is much more detailed. Ground-water and 110 (April 1959). er ; 
surface-water monitoring are discussed, as well 5. J. E. Cunningham et al., Specifications and Fabri- As 
. ves : : y cation Procedures for APPR-1 Core II Stationary § qos; 
as the advisability of the sampling of water biota Fuel Elements, ORNL-2649, Feb. 11, 1959. (Un- ra 
(algae, fungi, and plankton) and silt and mud from classified AEC report.) ° 
the stream bottoms. It is indicated that concen- 6. H. N. Culver, Cooling Water and Demineralizer oxpe 
tration mechanisms are important in the uptake Activities in NMSR, CF-58-5-83, May 14, 1958, f O07” 
of the different radioisotopes and that this effect (Unclassified AEC report.) a 
must be allowed for in the sampling program. 7. J. L. Meem, Cobalt Activity Buildup inthe Nuclear § Ala 
For example, in fish, strontium and cesium Merchant Ship Reactor, BAW-1130, Oct. 1, 1958. of I 
‘might best be located in bone and muscle, re- (Unclassified AEC report.) ult 
, ee : 8. J. L. Zegger and G. P. Pancer, APPR-1 Research §f The 
spectively. Not indicated, but certainly obvious, vem 
‘ : Spain d and Development Program Decontamination Pro- proc 
is the fact that an expert inthis field will be re- gram. Task II. Contamination and Decontamina- 
quired to make the interpretation of the data tion in Nuclear Power Reactors, APAE-43(Vol. 1), oo 
collected from such a comprehensive program. Feb. 13, 1959. (Unclassified AEC report.) ita 
The sampling program for radioactivity in the 9. W. T. Lindsay, Jr., Information Required to Define radi 
soil, vegetation, and in land animals is also quite Contamination Status of PWR, WAPD-PWR-CP- An 
comprehensive, but, again, the recommendations 3077, July 1957. (Unclassified AEC report.) that 
are purely descriptive. 10. S. J. Rodgers and G. E. Kennedy, Fission Product of th 
E : ct Release During a Simulated Meltdown of a PWR : 
For the sampling programs described it is es- . , attril 
' ‘ ype Core. Technical Report 63. MSA Research F 
timated that the capital cost would be $55,500. Corp., Oct. 20, 1958. equir 
Of this amount about $35,000 represents the 11. G. W. Parker and G. E. Creek, The Volatilization | duce 
cost of five monitoring stations, each equipped of Fission Products by Melting Reactor Fuel § 4 a 
with automatic continuous counting equipment Plates, CF-57-6-87, July 15, 1957. (Unclassified — injur. 
for the air-monitoring program. The remainder AEC report.) rator 
of the estimated captial cost is for laboratory 12. W. A. McAllister, Fission Product Release Stud- §| philo; 
facilities to handle the other samples. ies, WAPD-ADT(H)-55, Dec. 16, 1958. Ener; 
Tin: Dered ctneittiennce of ortateal ent 13. G. E. Creek, W. J. Martin, andG. W. Parker, Ex- i” ar 
gal sig e riginal records is eee 
ai periments on the Release of Fission Products from 
pointed out; film records are suggested to mini- Molten Reactor Fuels, ORNL-2616, Dec. 23, 1958. exerc 
mize storage problems. The personnel required (Unclassified AEC report.) tions 
for the described programs are estimated at 14. L. Brewer, High Temperature Decontamination 
four, three of whom would be technicians. and Separation Processes, UCRL-314, May 1949. los / 
(R. L. Clark) (Unclassified AEC report.) 
15. R. K. Hilliard, Effect of Heating Irradiated Ura- The 
nium. A Literature Survey, HW-52753, Nov. 1, F critic 
1957. (Secret AEC report). only 
16. A. C. Chamberlain, Relation Between Measure- that 
Ref erences ments of Deposited Activity after the Windscale d 
Accident of October 1957, AERE-HP/R-2606, | "@dia 
1. W. J. Small et al., Long-lived Circulating Activity September 1958. (Unclassified British report.) tem. 
in the Army Package Power Reactor, APAE-20, 17. D. V. Booker, Physical Measurements of Activity of the 
Aug. 28, 1957. (Unclassified AEC report.) in Samples from Windscale, AERE-HP/R-2607, # and ot 
2. J. L. Zegger et al., Radiochemical Analysis of October 1958. (Unclassified British report.) At 
Crud from the Army Package Power Reactor, 18. H. Blatz and A. Edelmann, Are Surveys Necessary, 
APAE-26, Feb. 15, 1958. (Unclassified AEC re- Nucleonics, 17(1): 57 (January 1959). vento; 
port.) 19. C. A. Pelletier, Environmental Survey for Nuclear extrac 
3. W. S. Brown et al., Corrosion Product Activity in Facilities, Nucleonics, 17(1): 56, 58-59 (Janu- trate 
the Primary System of the Army Package Power ary 1959). cover’ 
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CURRENT EVENTS 








Nuclear Incidents 


As used in this Review “nuclear incident” is 
defined as a nuclear accident in which one of 
the following occurred: (1) serious personnel 
exposure, (2) significant contamination of the 
surroundings, or (3) substantial damage to the 
reactor. Two incidents reported here, the Los 
Alamos accident and the Boris Kidrich Institute 
of Nuclear Studies (Yugoslavia) accident, re- 
sulted from inadvertent critical assemblies. 
The Los Alamos accident occurred in chemical 
processing equipment, and the Kidrich accident 
was in a critical experiments facility. In both 
instances the nuclear excursion resulted in a 
radiation fatality. 


Analyses of both of these incidents indicate 
that they could have been avoided. In the case 
of the Los Alamos accident, which was directly 
attributable to operator errors, changes in 
equipment and procedure are planned to re- 
duce the probability of the recurrence of such 
an accident. The low incidence of radiation 
injuries in American nuclear plants and labo- 
ratories is largely attributable to the safety 
philosophy and constant vigilance of the Atomic 
Energy Commission. The possible consequence 
of an environment where such control is not 
exercised is illustrated in the various descrip- 
tions of the Kidrich Institute accident. 


los Alamos Criticality Accident 


The early reports'” on the’ Los Alamos 
criticality accident of Dec. 30, 1958, covered 
only the bare facts on the accident and stated 
that the operator, Cecil W. Kelly, died of 
radiation damage to the central nervous sys- 
tem. The results of the official investigation 
of the accident were reported by H. C. Paxton 
and others. *** 


At the time of the accident, a physical in- 
ventory was in progress in the TBP solvent 
extraction plant used to recover and concen- 
trate “lean” residues from a plutonium re- 
covery operation. Residual materials in all 


process vessels were to be evaluated for plu- 
tonium content. 

Reconstruction of significant events leading 
up to the accident indicates that plutonium- 
rich solids, which ‘normally would have been 
handled separately, were washed from two other 
vessels into a vessel that contained dilute 
aqueous and organic solutions. After removal 
of most of the aqueous solution, the remaining 
material was transferred to the solvent-treating 
tank in which the accident occurred. In addition, 
concentrated nitric acid was used to wash solids 
from the bottom of the vessel into the solvent- 
treating tank. The solvent-treating tank already 
contained a caustic-stabilized aqueous-organic 
emulsion. Transfers were followed by air- 
sparging, and therefore the emulsion was broken 
by acidification, the plutonium originally in the 
solids was extracted into the solvent, and the 
phases separated. 


The resulting mixture in the 225-gal, 38- 
in.-diameter, solvent-treating tank immediately 
before the accident is believed to have con- 
sisted of 87.4 gal of aqueous solution contain- 
ing 40 g of plutonium and, on top, a 42.2-gal 
layer of solvent containing 3.27 kg of plutonium. 
Solids (containing 60 g of plutonium) were 
suspended in both the aqueous and organic 
phases and at the interface. Estimates indicate 
that the 8-in.-thick solvent layer was barely 
(roughly 5 dollars) subcritical at the plutonium 
concentration of 20 g/liter. 

A chemical operator started the motor for 
driving the stirrer in the solvent-treating tank. 
The initial action of the stirrer in the solvent- 
treating tank forced aqueous solution up along 
the wall, displacing the outer portion of the 
solvent layer and thickening the central portion. 
There was a “blue flash” and a muffled report. 
The burst was certainly terminated by the 
violent disturbance that it generated, and con- 
tinuation of the stirring diluted the plutonium 
beyond the point at which a critical reaction 
could recur. 

The operator, who was looking into a sight 
glass at the top of the tank, was knocked off 
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the two-step ladder on which he stood. He 
apparently turned the stirrer motor off and 
then on again, ran out a nearby exterior door, 
and called that he was “burning up.” Although 
the shock displaced the tank about *% in. at 
its supports, it was not ruptured and no plu- 
tonium escaped. 

At the time of the burst, a second operator, 
who was about 40 ft away in an adjoining room, 
saw a reflection of the light on the walls, heard 
the report, went to help, and was joined by 
another operator. These two operators led the 
injured operator to a shower. As the three 
passed the tank in which the accident occurred, 
the second operator turned off the stirrer. 

The injured operator went into deep shock 
within 15 min of exposure. He regained con- 
sciousness about 6 hr later and remained 
rational and confortable until nearly the time 
of his death, about 35 hr after exposure. The 
operators who went to his assistance showed 
no physical effect of exposure other than a 
typical change in blood count in the case of 
the man who arrived first and switched off 
the stirrer motor. Both have continued on 
regular duty. The fatally injured man received 
a radiation dose estimated at 12,000 rem 
(+50 per cent). The next highest doses received 
by any of the operating personnel were esti- 
mated at 134 and 53 rem. Other exposures 
from the supercritical burst were less than 
4 rem. Radiochemical analyses for Mo” indi- 
cate that the total number of fissions in the 
burst was about 1.5 x 10". 

A nuclear-criticality review of the entire 
plutonium plant had been completed about a 
month before the accident. Changes in equip- 
ment were planned to reduce dependence on 
procedural control of batch sizes for nuclear 
safety purposes. The existing type of control 
had been used successfully during the 7'/, years 
that the plant has been in operation. 

Since the accident there has been further 
detailed review of the entire plutonium plant, 
and the following additional safety steps have 
been taken: 

1. Geometrically favorable dissolvers and 
feed tanks have been designed for filtration 
and solvent extraction. 

2. Supplementary transfer lines have been 
blocked to minimize the opportunity for ab- 
normal interchanges. 
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3. Cadmium nitrate solution has been placed 
in vent tanks and vacuum-buffer tanks to pro- 
tect against criticality in case plutonium solu- 
tions are accidentally introduced. The use of 
both soluble and fixed neutron poisons in large 
process equipment is being studied. Both these 
methods present difficulties since the soluble 
poison may result in unequal distribution be- 
tween the phases and there is a possibility of 
plutonium deposition on the surface of the fixed 
poison. 

4. Neutron detectors for indicating abnormal 
deposits of plutonium have been calibrated and 
tested. 


The investigation review committee found’ 
that the accident was directly attributable to 
errors on the part of the deceased operator in 
handling several batches of material together 
instead of one at a time. They also found that 
the procedures for this process were such that 
safety of operation depended substantially on 
the ability and judgment of individual op- 


erators but that the incident might have been 
prevented had the organizational arrangement 


required closer supervision to ensure that 
normal procedures were followed. The Com- 
mittee commended the Los Alamos Scientific 
Laboratory on the thorough evaluation it made 
of the accident and on the planning of measures 
to be taken to prevent a recurrence. 

(C. E. Guthrie) 


Kidrich Institute Accident 


The natural-uranium-fueled, D,O-moderated, 
unreflected, critical assembly at the Boris Kid- 
rich Institute of Nuclear Science, Yugoslavia, 
became critical inadvertently on Oct. 15, 1958, 
and caused significant radiation exposure to 
eight members of the technical staff. One 
fatality resulted. The incident has been recently 
described by Savi¢c;' an earlier report ap- 
peared in Nucleonics.® 

The core of the assembly’ is a lattice of 
natural uranium rods, each 210 cm long and 
2.5 cm in diameter, located at a 12-cm center- 
to-center spacing. The over-all lattice diameter 
is about 200 cm, and the uranium inventory is 
about 4 tons. Control is primarily effected by 
adjustment of the heavy-water level as it is 
transferred, by a pump, from a storage tank 
located below floor level. Water can be pumped 
into the tank at two rates corresponding, at 
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near critical, to 3.75 and 1.2 per cent 5k/min. 
Neutron detection instrumentation is conven- 
tional, consisting of three BF; proportional 
counters with associated scalers andrecorders. 
There is at least one logarithmic rate meter. 

The safety system consists of a “control key” 
through which power is apparently supplied to 
two magnetically supported, gravity actuated 
cadmium safety rods, each reportedly being 
sufficient to hold the system subcritical sepa- 
rately even with the tank completely filled with 
D,O. Dose rate meters for both thermal and fast 
neutrons and for gamma radiation give audible 
signals of radiation fields above preset rate 
levels. Suitable circuitry is provided to shut 
down the reactor, by dropping the rods, upon 
radiation signal. It was apparently possible to 
start the reactor in a normal manner with the 
instrumentation de-energized. (The relation of 
the magnet supply at the time of the accident 
to this condition is not clear, if the worth of 
the rods is that reported.) The assembly is 
unshielded. 

At the time of the accident the personnel are 
reported to have been engaged in a “subcritical 
experiment” at distances of 3 to 8 meters 
from the tank. No monitor, safety, or control 
instrumentation was operating. By a means 
which is not mentioned, D,O was transferred 
(possibly pumped) from the storage tank into 
the assembly tank, through a vertical distance 
of at least 4 meters, without cognizance by 
any of the persons present. The resulting super- 
critical assembly was first detected by an odor 
of ozone. The immediate actions, which no 
doubt stopped the reaction, are not described. 
The time of the energy release is indicated 
to be the order of 10 min from a record by an 
air monitor some 540 meters distant, and the 
magnitude was evaluated as 8 x 10’ watt-sec 
(2.4x 10'® fissions). The power versus time 
pattern is not reported and, presumably, not 
determinable. 

Personnel exposures to thermal neutrons 
were estimated from activities induced in metal 
objects carried by the individuals and in body 
fluids. Epithermal-neutron (<1 Mev) and fast- 
neutron exposures and the gamma-ray expo- 
sure were estimated from the characteristics 
of the reactor core and from measurements 
of the leakage spectrum. The estimated av- 
erage whole-body dose was 683 rem, which 


was made up of 49 rem from thermal neutrons, 
223 and 116 from epithermal and fast neutrons, 
respectively, and 295 rem from gamma rays. 
Body areas nearer the points of incidence of 
the neutrons experienced, of course, exposures 
estimated to be two or three times the whole- 
body average. 

The six most severely exposed patients were 
treated at the Curie Foundation in Paris.® 
Five of the patients received bone marrow 
treatment (~10 billion nucleated cells of aspi- 
rated marrow from healthy donors). The patient 
who received the greatest exposure died a 
month after the accident from complications 
in the respiratory and gastrointestinal tracts. 
The other four patients as well as the sixth 
worker who did not require bone marrow treat- 
ment are recovering. 

Lack of a detailed description of the actual 
cause of the accident and, to a lesser extent, 
of the manner in which the reaction was stopped 
preclude any well-defined conclusions being 
drawn for the guidance of others operating in 
this or related fields. It is quite obvious that 
there was a serious design deficiency in the 
electromechanical interlocks intended to pro- 
hibit unattended and uncontrolled operation and/ 
or a Significant failure in their functioning, 
provided, of course, the operational philosophy 
of the Institute demands such interlocks. If, 
as an alternate, more reliance is placed on 
administrative control, it, too, was not thorough. 
To be more definitive in an analysis would re- 
quire detailed knowledge of several special 
situations during the incident, including the 
location of the control key and of the safety 
rods, the operation of the electrical circuits 
controlled by the key and of the circuit supply- 
ing the safety-rod magnets, and other items 
that are individually of small import but which 
in combination give insight into the sequence 
of events leading to the supercritical assembly. 

A mild sense of complacency can be detected 
in the report!® of data on the leakage radiation 
when the assembly is critical at low power. 
These data are purported to show that “this 
reactor, although completely unprotected, could 
have been used safely up to the critical point 
and even over critical with a period of a few 
minutes for the personnel around the reactor.” 
This analysis may have been corrected so long 
as an unexpected and unplanned event, such as 
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that being reviewed, did not occur. The analysis 
led to a false sense of security. Since none of 
the nuclear accidents which have occurred, 
either in critical experiment facilities or in 
chemical process operations, were the result of 
an “expected” procedure, personnel protection 
must always be provided for the maximum “un- 
expected” event. It is well known that although, 
in general, the consequences of a nuclear 
accident in a critical assembly will have a 
much more limited range than those of a re- 
_actor runaway, the very nature of critical 
assemblies and their operation makes them 
more susceptible to accidents. Therefore equal 
protection of personnel nearby the two types 
of operation is necessary. The inclusion of 
shielding materials or of protection-by-distance 
is general practice in the design and use of 
critical experiment laboratories even for “zero” 
power operations. Lack of detailed knowledge 
of the operation leading to this accident pre- 
cludes drawing any conclusions regarding the 
relation of this tragic occurrence and the 
philosophy implied in the above quotation. The 
concluding statement of one of the papers 
reports the construction of an underground 
control room “with which even higher excursions 
with the reactor might be made.” It is not clear 
that such caution is exercised in all critical 
experiments. (A. D. Callihan) 


Regulatory Role of the 
Atomic Energy Commission* 


The Atomic Energy Act of 1954 requires that 
licenses be granted by the Atomic Energy Com- 
mission before nuclear facilities canbe built and 
operated by institutions and organizations out- 
side the Federal Government’s program. Before 
such licenses can be given, the Commission re- 
quires reasonable assurance that the health and 
safety of the public will not be unduly endangered 
by operation of the proposed facilities. It is the 





*This section is based substantially on Geneva 
Conference paper, A/CONF.15/P/2407, written by 
Dr. C. K. Beck, Licensing and Regulation Division, 
U. S. Atomic Energy Commission, Drs. M. M. Mann 
and P. A. Morris, Inspection Division, U. S. Atomic 
Energy Commission. 


responsibility of the applicant to design a facility 
for which safe operation can be expected, andto 
present fully his plans for construction and op- 
eration, for independent analysis and evaluation 
by the Commission. The Commission in turn is 
responsible not only for evaluating the safety of 
proposed facilities and making periodic inspec- 
tions of their operation, but also has the obliga- 
tion to make all information accumulated from 
its research and development programs fully 
accessible to any parties interested in designing 
reactors. 


Thus, the present procedures and regulations 
followed in arriving at decisions on the safety 
of proposed facilities may be summarized as 
follows: 


1. The Atomic Energy Commission makes 
available to potential reactor designers and 
other interested parties information pertaining 
to the safety of nuclear facilities. 

2. An applicant is required to present full in- 
formation to the Commission on his proposed 
plans, details of the reactor design, analysis of 
probabilities and consequences of possible acci- 
dents, and the evidence for his belief that the 
proposed system can be operated safely. 

3. The Division of Licensing and Regulation of 
the Commission makes analysis and evaluation 
of the potential hazards of the facility and the 
adequacy of safeguards provided. 

4. If the facility is authorized, the Inspection 
Division of the Commission determines the state 
of compliance with design criteria and specifica- 
tions and evaluates safety of operation as de- 
scribed below. 


Factors Considered in 
Reactor Site Evaluation 


Before a license for operation can be given, 
the basic decision required is that there is rea- 
sonable assurance that the facility can be con- 
structed and operated at the proposed location 
without undue risk to the health and safety of 
the public. Two essential criteria that are ap- 
plied to any proposed site-reactor combination 
in arriving at this decision are: (1) in normal 
effluents of plant operation, the radioactivity 
released must not result in levels beyond the 
site boundary in excess of the maximum per- 
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missible levels for continuous exposures; and 
(2) from possible accidents, the radioactivity 
that might be released, even from the worst 
accident whose occurrence is considered credi- 
ble and under the most pessimistic dispersion 
conditions, must not result in doses beyond the 
site boundary in excess of permissible (once in 
a lifetime) emergency doses. 

The important features of the proposed site 
must be considered in applying these criteria. 
But the decision cannot be made on site data 
alone. It is equally important that the features 
of the reactor and of its associated equipment be 
considered. Thus, the reactor and the site must 
be evaluated together, and it follows that certain 
safety deficiencies or inadequacies in either the 
reactor or the site can be offset inpart by com- 
pensating characteristics in the other. 

The technical safety analysis and evaluation of 
any proposed reactor-site combination is made 
largely on the basis of information presented by 
the applicant in a Hazards Summary Report. In 
practice, the report usually consists of two 
parts: (1) a Preliminary Hazards Report, pre- 
sented relatively early in the life of a project, 
when a construction permit is sought, and when 
the design features of the plant are stillfar from 
crystallized, and (2) a Final Hazards Report, 
presented when the design is completed, con- 
struction is nearly complete, and an operating 
license is being sought. 

These reports together present several cate- 
gories of information, from which the necessary 
decisions on safety, as indicated above, may be 
made. 

1. Descriplion of pertinent sile data: The ap- 
plicant here gives a complete quantitative de- 
scription of all environmental features relative 
to safety (or hazards) of the facility, the size 
and location of the applicant’s property holding, 
the position of the facility onthe property, popu- 
lation and its distribution in the surrounding 
areas, a summary of important features of 
meteorology, hydrology, geological characteris- 
tics, and seismological history. These data are 
summarized by the applicant with an identifica- 
tion of the significant features, favorable or un- 
favorable with respect to the safety aspects of 
the proposed facility. 

2. Description of the reactor: This includes 
description of the nuclear, thermal, hydraulic, 
mechanical and chemical characteristics, 


Shielding features, and instrumentation and 
control systems. These descriptions are re- 
lated to the functions to be performed and to 
the basis for the final choice of performance 
specifications. 

3. Descriplion of auxiliary systems: The de- 
sign of the systems is delineated, with emphasis 
on the features relevant to safety. Dimensions, 
functional arrangement of the building, contain- 
ment specifications, waste disposal systems, 
power and cooling systems, and the potential in- 
teraction of these features with the reactor are 
described. 

4. Oulline of administration and organization, 
operating plans, policies, and procedures: De- 
scription is given of the organizational struc- 
ture, the areas of authority and responsibility 
of the operating staff, the procedural ground 
rules and policies, and the plans and procedures 
to be followed in case of accident or emergen- 
cies. 

5. Analysis of the extent of hazards and the 
adequacy of safeguards: Potential hazards that 
could arise from operation of the facility are 
defined. Description leads to a set of assump- 
tions, realistically related to the characteristics 
of the reactor and the design of the facility, 
which would result in an accident having conse- 
quent damages not expected to be exceeded by 
any other credible accident. Having defined 
these assumptions, analysis is made of the con- 
sequences both to the occupants of the facility 
and the inhabitants of surrounding public areas, 
and it is required that the consequent damages 
to the public, even from this maximum credible 
accident, would not be beyond those considered 
acceptable. 


Primary staff responsibility for reactor haz- 
ards evaluation rests with the Hazards Evalua- 
tion Branch of the Division of Licensing and 
Regulation. The Commission is assisted in 
carrying out its reactor safety functions by the 
Advisory Committee on Reactor Safeguards. 
This statutory committee reviews safety studies 
and facility licensing applications referred to it 
and makes reports thereon, advises the Com- 
mission with regard to the hazard of proposedor 
existing reactor facilities and the adequacy of 
proposed reactor safety standards, and per- 
forms such other duties as the Commission may 
request. The Committee’s report onapplication 
for facility licenses becomes a part of the rec- 
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ord application and is available to the public, 
except for security material. Members are ap- 
pointed by the Commission for a term of four 
years, and one member is designated by the 
Commission as its chairman. 


Inspection Objectives 
and Criteria 


Objectives 


As stated previously, safety of reactor opera- 
tion is influenced by two principal factors: (1) 
the design of the reactor and its associated 
equipment, and (2) the manner in which the re- 
actor is operated. 

The design of a reactor and the manner in 
which it is constructed define a number of com- 
plex relationships among the physical character- 
istics of the reactor, its location and contain- 
. ment, the instrumentation, and the control and 
safety systems. These relationships are evalu- 
ated, to a large extent, before an operating li- 
cense is issued, by the Division of Licensing 
and Regulation as part of its over-all review of 
the proposed design and operating plans. The 
evaluation of these relationships, by itself, 
serves to define the maximum credible accident 
and, therefore, the maximum potential hazard 
to the public. 

Whether or not the reactor can be operated 
safely depends not only on design features and 
inherent safeguards, but also upon the oper- 
ational procedures, the training and skill of peo- 
ple, and the effectiveness of administrative con- 
trol and management. The effect of these factors 
on safety of reactor operation can be evaluated 
only partially during construction of the reactor. 
Final evaluation can be made only when the re- 
actor is completely constructed and is operated 
according to established procedures, by the nor- 
mal operating organization. This evaluation 
made by the Division of Inspection, together with 
the evaluation of the physical characteristics, 
serves to define the probability that a serious 
reactor incident may occur. 

Objectives of reactor inspection are statedas 
follows: 

1. To determine that the facility is actually 
constructed in accordance with the proposed de- 
sign, as approved in the construction permit or 
license. 


2. To determine the manner in which the re- 
actor will be or is operated. 

3. To judge the over-all safety of reactor op- 
eration, with due regard for the combined con- 
sequences of the above two determinations. 


Scope of Reactor Inspection 


Inspection activities generally take the fol- 
lowing sequence: 

1. Familiarization during design review and 
hazards evaluation activities. 

2. Observation and review of construction 
progress. 

3. Observation and review of tests of equip- 
ment and procedures before operation. 

4. Observation and review of the initial charg- 
ing of fuel, initial reactor start-up, and oper- 
ational program. 

5. Periodic observation and review during 
normal operation. 


Reactor inspection is carried out by a small 
staff of reactor specialists under the assistant 
director for compliance of the Inspection Divi- 
sion, occasionally supplemented by technical 
people from AEC headquarters and field offices, 
and outside consultants chosen for their spe- 
cialized knowledge. Recommendations of the 
Division of Inspection are forwarded to the Gen- 
eral Manager of the AEC. Actions by the AEC 
with regard to the activities of licensees, when 
required, are taken through the Division of Li- 
censing and Regulation. 

Subjects that are considered during review 
and inspection of reactors include the following: 
status of construction; schedule and plans for, 
and check of, “conventional” inspections;* pro- 
grams for observation and review of tests, as- 
sembly, and initial operation; physical arrange- 
ment and environment; the control system; the 
safety system; instrumentation; reactivity; heat 
generation, transfer, and distribution; kinetics 
and dynamics; shielding and radiation control; 
normal and emergency operating standards, 
procedures, and practices; and organization and 
management. 





***Conventional’’ inspections are those against ex- 
isting engineering standards, codes, or the like, that 
do not involve special requirements or knowledge 
based on nuclear considerations. 








cili 
any 
nur 
of | 
son 
sig 
to i 
fac 
vis 
bee 
the 


of | 
aut 
nec 
upo 
rod 
stal 
cha: 
can. 
the 
that 
bili 
is n 


horr 
ope 
ture 
whit 
thar 
tion 
to ii 
evel 
cha 
sub: 
diffe 
helc 
of t 
anal 
pors 
too 


seal 
num 
to ¢ 
the | 
Imp 
lock 


reac 
trol 
adju 





fol- 
and 
tion 
uip- 


irg- 
er 


ring 


mall 
tant 
ivi- 
ical 
ces, 
spe- 

the 
7en- 
AEC 
vhen 

Li- 


view 
ring: 
for, 
oro- 


nge- 
; the 
heat 
tics 
trol; 
rds, 
1 and 


t ex- 
that 
ledge 





CURRENT EVENTS 43 


Construction and preoperational testing of fa- 
cilities have, so far, presented few problems of 
any direct relation to operational safety. Ona 
number of occasions, however, detailed review 
of operations and equipment by inspection per- 
sonnel has indicated that certain changes in de- 
sign or in the method of operation couldbe made 
to improve safety. In all cases, solutions satis- 
factory to both licensee and the Inspection Di- 
vision have been found and voluntary action has 
been taken by the licensee. Some examples of 
these situations are the following: 

1. During observation of preoperational tests 
of a research reactor, it was found that the 
automatic reactor control system was so con- 
nected that shim-safety rods could be called 
upon to increase reactivity should the regulating 
rod be unable to maintain the reactor at con- 
stant power. Discussion of this situation led to 
changes in circuitry such that shim-safety rods 
cannot be moved except upon direct demand of 
the operator. The principle involved here is 
that of design of equipment such that the possi- 
bility of increase in reactivity upon malfunction 
is minimized. 

2. In the case of a research reactor, using a 
homogeneous solution as fuel, it was noted that 
operation at a higher power planned for the fu- 
ture, would require the use of a fuel mixture in 
which the ratio of hydrogen to uranium was less 
than optimum. Under these conditions, the addi- 
tion of water to the core would cause reactivity 
to increase. Such an increase could occur inthe 
event of malfunction of certain equipment. This 
change in reactivity, therefore, could decrease 
substantially the margin of control, that is, the 
difference between reactivity of the core and that 
held by the control and safety rods. Discussion 
of this question prompted the licensee to re- 
analyze the situation in detail and to defer tem- 
porarily application to the AEC for permission 
to operate at the higher power. 

3. Inspection of a reactor designed for re- 
Search and training purposes disclosed that a 
number of changes to equipment could be made 
to enhance substantially the inherent safety of 
the reactor, particularly when used for training. 
Improvements included, for example, an inter- 
lock to provide for a minimum count rate before 
reactor start-up, and the removal from the con- 
trol console of an easily operated control for 
adjusting trip levels for the safety circuits. 


Further consideration of training problems by 
the constructor led to a number of additional 
modifications, all of which are viewed by the 
constructor and the inspection group as material 
contributions to operational safety. 

4. In the case of a completed critical facility 
before intial operation, it was determined that 
the operating staff had only very limited experi- 
ence with critical experiments and reactor op- 
eration. The senior management of the organ- 
ization, as a result of this observation, made 
effective use of a number of thoroughly experi- 
enced advisors during initial operations of the 
facility. 


License Applications and Actions 


Some of the more recent reviews of appli- 
cations for construction permits or licenses to 
operate are discussed here. In general, only 
the particular applications that present unusual 
hazards or establish safety philosophy or prec- 
edents are discussed. The information pre- 
sented in these reviews is available at the AEC 
Public Document Room, Washington, D. C. In 
addition to this source of information, reviews 
of all the recent license applications are given 
in a weekly publication, Atomic Energy Clearing 
House, published by the Congressional Informa- 
tion Bureau, Inc. 


Yankee Atomic Electric Company Reactor 


Several amendments to the Yankee Atomic 
Electric Company license application have been 
reviewed by the HEB and the ACRS and have 
been found to be satisfactory with the reserva- 
tions noted. An amendment of interest is con- 
cerned with the effect on the reactor’s nuclear 
parameters of the build-up of plutonium in the 
core over the reactor lifetime. The ACRS had 
originally suggested that the effect of plutonium 
build-up be investigated in a part-core critical 
assembly using synthetic fuel elements con- 
taining large-exposure plutonium. Yankee felt 
that such an experiment would be difficult to 
interpret because of the impossibility of dupli- 
cating the temperature and neutron spectrum 
in such a facility. Therefore Yankee proposed 
to conduct an experimental program to measure 
the temperature coefficient and other core 
parameters affecting operation in the actual 
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reactor at startup, after 2000 hr of operation, 
and at intervals while plutonium is building up 
in the core. Since independent calculations by 
Westinghouse Electric Corporation and Nuclear 
Development Corporation of America indicate 
that the build-up of plutonium has only a minor 
effect on the reactor’s nuclear parameters, 
both the HEB and the ACRS concurred with 
the Yankee proposal to determine the tempera- 
ture coefficients in the actual reactor. The 
HEB felt, however, that before an operating 
license was granted that Yankee should furnish 
‘ a description of the specific experiments to 
be performed on the reactor and the experi- 
mental procedures to be followed, together with 
evidence that the proposed experiments and 
procedures would provide information necessary 
to predict the effect of plutonium build-up on 
reactor characteristics. Final action on these 
amendments had not been taken by the AEC as 
of June 1, 1959. 


Dresden Nuclear Power Station 


The AEC has announced that a hearing was 
held at AEC Headquarters on July 9, 1959, to 
consider the issuance of a license to the 
Commonwealth Edison Company to operate the 
Dresden plant. The report of the ACRS in this 
matter has indicated that this reactor can be 
started and operated without undue risk to the 
public. 

The ACRS commented specifically concerning 
the control rods, flux monitors, and the contain- 
ment vessel. The Committee felt that since the 
Dresden plant has a large number of control 
rods that depend completely on a complex 
hydraulic system for normal operation and for 
scramming that it is essential that frequent 
and thorough periodic checks be made of this 
system. Because of the large size of the re- 
actor, both external and internal neutron flux 
monitors are necessary, at least during early 
operation, to ensure safe control of the reactor 
at high power levels. During early operation of 
the reactor at high power, it is understood that 
the plant will operate with at least five external 
ion chambers and 32 internal ion chambers. 

In addition to all other safeguards, the con- 
tainment shell around the reactor, which is 
supplemented by a well-designed emergency 
cooling system, will provide adequate protection 
for the public. 


Consolidated Edison Thorium Reactor 


The Consolidated Edison Company has sub- 
mitted an amendment to its construction permit 
to cover the technical specifications for the 
containment vessel of the plant. Based on a 
review of the information contained in the ap- 
plication and the reports of the ACRS, some 
of the Commission findings are: 

1. The containment vessel is designed in 
accordance with Section 8 of the ASME Boiler 
and Pressure Vessel Code (1956 edition) as 
modified by a number of Code cases applying 
to containment vessels for nuclear plants. The 
design is based on a working pressure of 
25 psig, and the vessel will be pneumatically 
tested at 31.25 psig. 

2. The vessel will probably have a leakage 
rate not in excess of 0.1 per cent per day at 
25 psig. 

3. Although the maximum credible accident 
for the proposed reactor, as presently designed, 
and the consequences of the accident have not 
been definitely established, the hypothetical 
accident postulated by the applicant results in 
consequences within acceptable limits even 
though the conditions are more severe than 
would reasonably be expected. 

4. The containment vessel structure should 
be adequate as designed to prevent an undue 
hazard to the health and safety of the public, 
and approval was given to the mechanical de- 
sign of the vessel, the internal arrangement of 
equipment, and the leakage analysis. 

Final construction approval, however, must 
await further analysis of the effects of the 
maximum credible accident and analyses of the 
proposed solutions to the remaining problems: 

1. A determination must be made as to 
whether means should be provided to relieve 
excessive negative internal pressure. 

2. A design must be evolved for the penetra- 
tions in the sphere that will ensure the integrity 
of the pressure shell. 

3. Adequate means must be available for 
closure of all penetrations that carry fluids 
that might be radioactive or through which 
the post-accident atmosphere might escape. 

4. Means must be provided for rapid sealing 
of the sphere in the event of release of radio- 
activity. 

5. The effect of internal missiles on the con- 
tainment shell must be evaluated. 
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Westinghouse Testing Reactor 


The Division of Licensing and Regulation of 
the AEC and the ACRS have reviewed the 
Westinghouse Testing Reactor (WTR) and have 
concluded that this reactor may be operated 
without undue hazards to the health and safety 
of the public. 

Included in the provisions of the proposed 
license are several operating restrictions that 
are of interest in that they specify the responsi- 
bility of the applicant and of the AEC in matters 
of alterations to the plant. 

The operating restrictions clearly establish 
the maximum allowable power level of the re- 
actor, as well as the allowable excess reac- 
tivity above cold, clean critical. Furthermore, 
the over-all void and over-all temperature co- 
efficients must be negative and of such values 
that the facility can inherently withstand, without 
melting of fuel cladding, a step increase in 
reactivity of at least 1 per cent. 

The operating restrictions also provide that 
the operator may make the changes listed below 
but that these changes must be reviewed and 
approved by the Westinghouse Testing Reactor 
Safeguards Committee (WTRSC) and that the 
report of the group must be submitted to the 
AEC, who will advise Westinghouse within 15 
days if approval is not granted. Included in 
this category of changes are: 


1, Physical, nuclear, thermal, or hydraulic 
performance characteristics of the reactor core 
and/or high-pressure experimental loops or 
thimbles. 


2. Performance characteristics of the reactor 
control and safety systems. 


3. Number and type of experimental facilities. 
4. Reactivity limitations on experiments. 
5. Integrity of containment vessel. 


With the exception of these restrictions, 
changes may be made in the facility design, 
performance characteristics, and operating pro- 
cedures without further approval provided that 
an evaluation by the WTRSC of the hazards 
involved in the proposed change and the effect 
of the change on each of the postulated accidents 
analyzed in the final safety report do not indicate 
that the hazards are increased or that a mate- 
tial alteration of the facility is required. 





In addition to these operating restrictions, 
the proposed license makes it necessary for 
the licensee to keep the following records: 

1. Reactor operating records, including power 
level. 

2. Records of activity release into the air 
or water beyond the effective control of West- 
inghouse. 

3. Records of emergency shutdown and rea- 
sons therefor. 

4. Records describing each change authorized 
by the WTRSC and a summary statement of the 
bases for the conclusions reached by the Com- 
mittee. 

5. Records containing a description of each 
test or experiment conducted in the facility. 


Further, Westinghouse must make an im- 
mediate report in writing to the Commission 
on any indication or occurrence of a possibly 
unsafe condition relating to the operation of the 
facility. Westinghouse must also submit to the 
Commission a report on the results of opera- 
tion of the facility pertinent to safety during the 
various power tests and identify any changes in 
the facility design, performance characteristics, 
and operating procedures. An annual report of 
operating experience and changes in facility 
design, performance characteristics, and op- 
erating procedures is also required. 

A public hearing was held in March, and 
following this hearing the AEC hearing examiner 
recommended that an operating license be 
issued to the Westinghouse Electric Corporation. 


Vallecitos Boiling Water Reactor 


Many amendments have been made to the 
license application of the General Electric 
Company for the Vallecitos Boiling Water Re- 
actor, and three of particular interest, Amend- 
ments 24, 33, and 34, are described here. 
Amendment 24 is designed to provide the op- 
erator with greater latitude in the choice of 
fuel elements and operating limits. The ACRS 
believes that the technical specifications set 
out in Amendment 24 define a scope of opera- 
tion within which it is possible to operate with- 
out undue hazards to the public since the speci- 
fications do not appear to increase the magnitude 
of the maximum credible accident. 

They feel, however, that the applicant has 
not demonstrated that the technical specifica- 
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tions will have no influence on the magnitude 
of the mca and that this point should be docu- 
mented more definitely. They emphasize that 
the technical specifications alone do not guar- 
antee safe operation of the reactor, especially 
from the standpoint of hazards within the 
boundary. 

Further, they. are concerned that the amend- 
ments to the licersee’s application onthe VBWR 
operation apparently stem from attempts to 
cover a multiplicity of specific situations perti- 
nent to the safe operation of the reactor. Rather 
than improving the safety, it seems possible 
that the real issues of safe operation may be- 
come clouded by changing one set of circum- 
stances for another. The ACRS suggests that 
the applicant be permitted within the scope of 
Amendment 24 to assume technical responsi- 
bility for the hazards in connection with the 
experimental programs. The latitude contem- 
plated in the proposed amendment imposes a 
special responsibility on the applicant to review 
each proposed change in operating conditions 
in the light of its effects on the probability of 
an accident and on the possible severity of the 
accident if it should occur. 

In Amendment 33, a request was made for 
authorization to install a nuclear superheater 
loop in the Vallecitos Boiling Water Reactor in 
which to test fuel elements. This loop will in- 
clude a fuel element test facility and will consist 
of a high-pressure process tube located inside 
the reactor vessel in a fuel element position. 
This process tube, which is designed to super- 
heat the primary reactor steam, will permit 
testing of one fuel element at a time. The fuel 
elements to be tested will each consist of a 
number of hollow, cylindrical, UO, pellets en- 
closed in concentric stainless-steel ‘tubing to 
form a cylinder. The initial fuel to be tested 
will be enriched to about 2.3 per cent in U?*®, 
and later experiments may test fuels with en- 
richments as high as 4.5 per cent. 

The provisions of the application state that 
the licensee will be required to maintain a re- 
actor scram interlock which will shut down the 
reactor if the steam temperature at the outlet 
from the loop reaches 1000°F and to observe 
operating procedures which will assure that 
the surface temperature of the cladding will 
not exceed 1200°F. In addition the applicant’s 
schematic diagram for the experiments indi- 


cates that reactor scrams may be included 
which will be actuated by high fuel cladding 
temperature, low coolant flow in the exit coolant 
line, high coolant activity at the vent condenser, 
low inlet-air pressure, or low steam pressure, 

The HEB feels that the scram on the steam 
outlet temperature, together with the responsible 
use of the other scrams, provides adequate 
protection against most of the possible acci- 
dents described by the applicant. They do not 
believe, however, that they ensure complete 
protection of the fuel elements in case of loss 
of coolant. On the other hand, inclusion of a 
scram which would shut down the reactor in 
the event the coolant flow through the loop was 
significantly diminished would provide better 
protection against rupture or melting of the 
fuel elements. Hence, it is their opinion that a 
scram which will shut down the reactor in the 
event the coolant flow through the nuclear super- 
heater loop drops below 80 per cent of the 
design flow for the particular test should be 
provided. 

It appears that no accident other than the 
maximum credible accident will result in a 
release of fission products outside of the nu- 
clear superheater loop. Since the mca in the 
loop will only result in doses equal to 1/500 
of those that would result from the mca of the 
reactor, the addition of the nuclear superheater 
loop to the VBWR facility and its operation in 
the manner described in the application, subject 
to the conditions described above, will not 
present any substantial change in the hazards 
evaluated previously in connection with the loop 
operation. 

The current license authorizing operation of 
the General Electric Vallecitos Boiling Water 
Reactor restricts operation to cores containing 
fuel elements of which at least 75 per cent are 
of substantially the same design and composi- 
tion. This restriction was imposed because of 
concern over the possibility of internal di- 
vergent power oscillations between groups of 
fuel elements having significantly different nu- 
clear thermal characteristics. Reactor experi- 
ments with heterogeneous cores containing plate 
and rod type fuel elements have been conducted 
within the present license restriction and have 
failed to indicate the existence of such oscilla- 
tions. Analytical attempts to predict the condi- 
tions required for such oscillations, or to prove 
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that they cannot exist with more heterogeneous 
cores, have been unsuccessful. Therefore, the 
applicant proposes in application Amendment 34 
a testing and evaluation procedure to demon- 
strate safely whether such oscillations exist 
with more heterogeneous core loadings than 
previously authorized. A successful demonstra- 
tion of safe operation will permit subsequent 
routine operations with core loadings essentially 
similar to those tested. 


The applicant proposes to increase the re- 


actor power level in a careful stepwise manner 
following a core loading change which might be 
expected to lead to internal oscillations. At each 
level a frequency-spectrum analysis of the 
noise signal from one normal out-of-core ion 
chamber and one or more in-core ionchambers 
will be made with instruments whose ranges 
are from 0.02 to 10 cycles/min. If the reactor 
demonstrates a tendency to instability, a peak 
will appear above the random noise spectrum 
at the frequency of oscillation, and an evalua- 
tion of the frequency spectrum will be made at 
each power level to determine whether it is 
safe to increase reactor power to the next level. 

The HEBin general believes that the licensee’s 
proposed procedures as modified by the license 
amendment will provide the proper degree of 
safety. However, they pointed out that from a 
safety point of view it is desirable to require 
that at least 75 per cent of any core utilized 
in the reactor be composed of fuel elements 
with characteristics that have been determined 
experimentally. They therefore believe that the 
license should provide that after it has been 
determined in accordance with the outlined 
experiment that the reactor can be safely op- 
erated with the heterogeneous core, the facility 
may be operated with cores composed of any 
combination of types of fuel elements provided 
at least 75 per cent of the fuel elements are 
of the plate type previously approved for use 
in the core and/or fuel elements of any other 
type which have successfully undergone all the 
tests specified in the final hazards summary 
report. 

The Hazards Evaluation Branch also pointed 
out that in the application for amendment it is 
Stated that the specified procedures will be used 
“following a core change which might be ex- 
pected to lead to internal oscillations.” This 
leaves the decision of whether or not to use the 


procedures to the licensee. Because of the 
present state of the knowledge and limited ex- 
perience with mixed fuel loading inthis reactor, 
there are no clear-cut criteria for making such 
a decision. For this reason the licensee should 
be required, before making any other changes 
in the basic core of the reactor, to conduct the 
following experiments, observing all the pro- 
cedures of the final hazards summary report: 

1. Replace approximately 12 plate type fuel 
elements with a like number of Dresden rod 
type elements. 

2. If this first test is successful, the licensee 
should replace approximately 12 additional plate 
type elements with a like number of rod type 
elements. 


Following this second change in core loading 
the core will consist of approximately equal 
numbers of plate and rod type fuel elements. 
Instabilities will be most likely to occur in this 
highly heterogeneous condition. If no instabili- 
ties are found in this condition, the HEB be- 
lieves that reliance on the applicant’s discretion 
to use the specified procedures will provide 
adequate protection. The licensee should be 
required to report to the Commission any in- 
stabilities observed during the experiments 
which might damage the fuel elements, and no 
further power increases should be permitted 
with the unstable loading until new procedures 
are approved by the Commission. 


The application does not specify the location 
of the in-core ion chambers during the conduct 
of these tests; however, the HEB believes that 
the license should require that these chambers 
be placed within the boyndaries of the largest 
clumps of grouping of similar fuel elements 
within the core. The ion chambers will then be 
in the most sensitive positions to detect insta- 
bilities. With the additions and/or changes 
noted above, the HEB believes that the pro- 
posed procedures described in the amendment 
can be executed safely and that they will not 
present any substantial changes in hazards and 
safety to the public from those already con- 
sidered and evaluated in connection with the 
previously approved operational facility. The 
General Electric Company has been granted 
approval by the AEC to operate the Vallecitos 
Boiling Water Reactor as proposed. 

(H. N. Culver) 
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Safeguards Reports 
and Bibliographies 


It is intended that in each issue of Nuclear 
Safely in the Technical Progress Review series 
safeguards reports which have recently been is- 
sued will be tabulated for the reader’s reference. 
Because of the similarity of many reactors, in 
particular the research reactors, the list is not 
intended tobe all-inclusive. Bibliographies per- 
taining to hazards and safeguards of reactors 
which have recently been issued will also be in- 
cluded for additional reference. 


Safeguards Reports 


1. L. E. Stanford, Safeguard Report on the Pro- 
posed Method of Annealing Graphite in the X-10 
Reactor, ORNL-2725, Apr. 20, 1959. (Unclassified 
AEC report.) 

2. J. M. Duncan, University of Florida Training 
Reactor Hazards Summary Report, University of 
Florida Engineering and Industrial Experiment Sta- 
tion, October 1958. 

3. Aerojet Nuclear Testing Reactor. Summary Haz- 
ards Report, AGN-3000, Aerojet-General Nucleonics, 
September 1958. 

4. E. G. Silver and J. Lewin, Safeguard Report 
for a Stainless Steel Research Reactor for the BSF 
(BSF-II), ORNL-2470, Aug. 11, 1958. (Unclassified 
AEC report.) 

5. C. G. Andre, Summary Safeguards Report for 
the Nuclear Test Reactor, GEAP-3068, General Elec- 
tric Corp., Oct. 7, 1958. 

6. Supplement to the LMFRE Preliminary Hazards 
Evaluation, BAW-1017-1, June 1958. 

7. P. W. Davison et al., Two-region Critical Ex- 
periments. Hazards Summary Report, WCAP-1029, 
Westinghouse Electric Corp., November 1958. 

8. J. A. Anno, Jr., et al., Hazards Summary Re- 
port for 2-Mw Operation of the Battelle Research 
Reactor, Battelle Memorial Institute, August 1958. 

9. C. M. Baldwin, Jr., et al., Summary Hazards 
Report for North Carolina State College Reactor 
NCSCR-4, North Carolina State College, Nov. 5, 1958. 


10. F. Schroeder, SPERT III Hazards Summary 
Report, IDO-16425, Jan. 14, 1958. (Unclassified AEC 
report.) 

11. Aerojet-General Nucleonics, December 1958 
and March 1959. (Unpublished.) 


Bibliographies 


1. Studies of Reactor Containment. Task on Struc- 
tural and Mechanical Design Criteria for Nuclear 
Reactor Containment. An Annotated Bibliography on 





Reactor Containment, ARF-D132 K03-1, Aug. 1958, 
(Unclassified AEC report.) 

2. Hazards and Safety Measures Related to Nuclear- 
Powered Merchant Ships: An Annotated Bibliography 
of Declassified Literature, ALI-51, Mar. 30, 1959, 
Compiled by M. K. White of Arthur D. Little, Inc. 
(Unclassified AEC report.) 
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LEGAL NOTICE 


This document was prepared under the sponsorship of the U.S, Atomic Energy Commission, Neither 
the United States, nor the Commission, nor any person acting on behalf of the Commission: 


A. Makes any warranty or representation, expressed or implied, with respect to the accuracy, 
completeness, or usefulness of the information contained in this report, or that the use of any in- 
formation, apparatus, method, or process disclosed in this report may not infringe privately owned 
rights; or 

B. Assumes any liabilities with respect to the use of, or for damages resulting from the use of 
any information, apparatus, method, or process disclosed in this report. 


As used in the above, ‘‘person acting on behalf of the Commission" includes any employee or 
contractor of the Commission, or employee of such contractor, to the extent that such employee or 
contractor of the Commission, or employee of such contractor prepares, disseminates, or provides 
access to, any information pursuant to his employment or contract with the Commission, or his em- 
ployment with such contractor. 














